Set up SPF, DKIM, and DMARC on Cloudflare
Add SPF, DKIM, and DMARC as TXT records under DNS > Records in the Cloudflare dashboard, using @ for the root and _dmarc for DMARC, with no surrounding quotes (Cloudflare adds them) and no proxy option to worry about.
Where to add records on Cloudflare
Log in at dash.cloudflare.com, pick your account if you have more than one, then click the domain (zone) on the account home to open it. In the left sidebar choose DNS, then the Records sub-item — that's where the records table and the "Add record" button live. (Cloudflare is rolling out a refreshed DNS Records page in 2026 with resizable columns and a card-based mobile layout, but the DNS > Records path, the "Add record" button, and the field names below are unchanged.)
- Go to dash.cloudflare.com and log in; if you have multiple accounts, select the account, then on the account home click the domain (zone) you want to edit.
- In the left sidebar click DNS, then Records, to open the DNS records table.
- Click 'Add record' above the records list.
- In the Type dropdown select 'TXT'.
- In the Name field enter the host: '@' for a root-domain record (SPF/DMARC policy at the apex), or a subdomain/selector label like '_dmarc' or 'selector._domainkey' — Cloudflare appends your domain automatically, so never type the full domain.
- Paste the record into the 'Content' field (Cloudflare's label for the value) exactly as given, with NO surrounding double-quotes — Cloudflare adds the quoting for you.
- Leave TTL on 'Auto' (or pick a value) and click 'Save'. (There is no proxy/orange-cloud option on TXT records.)
The three records on Cloudflare
SPF Sender Policy Framework
Create one TXT record with Name '@' (the apex/root). Cloudflare normalizes '@' to the bare domain (the zone name) in the table — that is correct. Put the policy in the Content field, e.g. 'v=spf1 include:_spf.google.com ~all', with no quotes. Publish only ONE SPF (v=spf1) TXT record per domain; if you send through multiple services, merge their include: mechanisms into that single record rather than adding a second SPF TXT.
DKIM DomainKeys Identified Mail
Cloudflare is a DNS host, not an email provider, so it does NOT generate DKIM keys — your email/sending service (Google Workspace, Microsoft 365, your ESP) generates the selector and key. Add what they give you: usually a TXT record at Name 'selector._domainkey' (e.g. 'google._domainkey' or 's1._domainkey') with the 'v=DKIM1; k=rsa; p=...' value in Content, or, if the provider hands you a CNAME-style selector (common with SendGrid/Mailchimp/Amazon SES), add it as a CNAME record instead of TXT. Enter only the selector label in Name — Cloudflare appends the domain.
DMARC reporting and policy
Add a TXT record with Name '_dmarc' (just that label — Cloudflare turns it into _dmarc.yourdomain.com). Content holds the policy, e.g. 'v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com', no quotes. Start with p=none to monitor, then tighten to quarantine/reject once SPF and DKIM are aligned. Cloudflare also offers a free built-in 'DMARC Management' feature (the domain's Email > DMARC Management section) that can auto-create a starter _dmarc record and parse the aggregate (rua) reports for you — note this is a separate product from Cloudflare's paid 'Email Security' (Area 1).
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
Cloudflare gotchas
- Cloudflare appends the zone name automatically: enter '@' for the root and just '_dmarc' (or 'selector._domainkey') for subrecords — typing '_dmarc.yourdomain.com' creates a doubled '_dmarc.yourdomain.com.yourdomain.com' record.
- Don't wrap the value in double-quotes in the Content field. If you save TXT content with no quotes, Cloudflare adds the proper quoting automatically; if you do include quotes they must be balanced/consistent, or Cloudflare rejects the record with a quotation validation error.
- Cloudflare handles long SPF/DKIM strings for you — paste the full value as one line (Content max is 2048 characters); it stores/serves the value split into 255-char chunks internally, so don't manually break it up.
- TXT records can't be proxied — there's no orange-cloud toggle, so proxy status is a non-issue for SPF/DKIM/DMARC (it only matters if you accidentally have a proxied A/CNAME on a mail host). Leave TTL on 'Auto' unless you have a reason to lower it.
- Propagation on Cloudflare is fast (often under 5 minutes), but downstream resolver/email caches can lag up to the old TTL; verify with 'dig TXT _dmarc.yourdomain.com' or an external checker before assuming it failed.
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on Cloudflare get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.