DMARC setup Cloudflare DNS — SPF, DKIM, DMARC TXT records
Cloudflare hosts DNS but does not send mail for you (beyond Email Routing for receiving), so SPF, DKIM and DMARC comes from whatever actually sends for you — Google Workspace, Microsoft 365, Zoho or an ESP. Cloudflare's DNS editor publishes TXT records verbatim, which is convenient, but it also lets you create multiple blank TXT records you forget about. Cloudflare's own Learning Center has a plain-English explainer on DMARC TXT records.
Records Cloudflare, Cloudflare DNS needs
| Record | Value |
|---|---|
| SPF (TXT, host @) | v=spf1 include:_spf.google.com ~all — substitute your actual mail provider's include |
| DKIM (TXT or CNAME at <selector>._domainkey) | <from your mail provider> |
| DMARC (TXT, host _dmarc) | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com |
Replace the placeholder parts (such as yourdomain.com or a generated key) with your own values. DKIM keys and subdomain CNAMES are never copied from a web page — generate yours in your own provider's console.
Merging SPF when you send from more than one source
Only ONE SPF record may exist per domain. If mail goes out through more than one service, the record carries a single v=spf1, one include: per source, and one -all (or ~all) at the end:
v=spf1 include:provider-a.com include:provider-b.net ~all
Each include costs one lookup and nested includes cost more; over 10 lookups receivers return PermError and treat your mail as if SPF failed entirely.
The 10-lookup limit
SPF counts every include:, a, mx, ptr, exists: and redirect= against a limit of 10 DNS lookups — and nested includes count too. Cloudflare, Cloudflare DNS's include is one lookup, but every merge pushes you closer to the cap. Our free checker counts for you; our USD 24 report gives you a flattened record that stays under the limit.
Official documentation
- Create DNS records
- Cloudflare Learning Center: What are DMARC, DKIM and SPF?
- Cloudflare Learning Center: DNS DMARC record
All links go to the provider's own docs; values in the table are examples, not copies of their pages.
Run your domain through the free checker before changing anything, so you know which records you already have.
Want the exact records for your domain?
For USD 24 we look up every TXT, CNAME and MX record your domain serves, count your SPF lookups, probe DKIM selectors, and write the exact records to paste — one SPF record, no PermError, DMARC at p=none with reporting — plus a free re-check after you apply them.