What is SPF Permerror?

SPF=Permerror indicates that there is a fundamental problem with the SPF record, making it impossible to determine if the sending server is authorized or not.

What is the 10 DNS lookup limit?

During SPF check, every time an email is sent from your domain, your recipient’s email server performs DNS query requests, also known as DNS lookups to check the presence of authorized IP addresses in your DNS and match them to the ones in the received email’s return-path header. However, RFC limits the number of DNS lookups to 10. This is known as the 10 DNS lookup limit.

Am I exceeding SPF Too Many DNS Lookups limit?

If you are worried about exceeding the lookup limit for SPF, you can check your record instantly using our SPF record checker tool.

How to fix SPF Permerror?

A more effective way to avoid SPF errors is to deploy an SPF flattening tool that is automatic and hassle-free – like PowerSPF!

How to Add Cloudflare DMARC, SPF, and DKIM Records? Easy Setup Guide

Yunes Tarada

2 months ago

How-to-Add-Cloudflare-DMARC,-SPF,-and-DKIM-Records.-Easy-Setup-Guide

Reading Time: 5 min

Cloudflare is one of the biggest content delivery network service providers in the world. Cloudflare can be used as your DNS host to add and edit DNS records for various operations. If you wish to enable DMARC, SPF, and DKIM for your domain, and your DNS hosting provider is Cloudflare – this guide is for you!

DMARC or Domain-based Message Authentication Reporting and Conformance is a protocol used to authenticate emails. Domains with DMARC implemented enjoy better security against spoofing, phishing, and impersonation attacks. DMARC also provides visibility into your email’s behavior and delivery channels.

SPF and DKIM are essential processes for email authentication which allows senders to authorize sending sources and make sure attackers in the middle do not alter email contents.

Let’s find out how you can set up SPF, DKIM, and DMARC for Cloudflare with a few easy steps.

How to Add DMARC Record to Cloudflare

You can setup DMARC records in Cloudflare DNS by following these steps:

1. Log in to Cloudflare

2. Select your account and domain.

3. Navigate to DNS > Add Record.

4. Keep this page open and sign up with PowerDMARC for free to access our DMARC record generator tool. Use this tool to create a DMARC record and copy the record syntax.

Note that the v= (version) field and p= (policy) field are mandatory fields in your DMARC Cloudflare record. Omitting any of these two fields will lead to an erroneous record. The value for the v= tag is always DMARC1. Your DMARC policy can be either of the three options depending on how strictly you wish to handle messages that fail DMARC:

1. None: take no action and deliver all emails

2. Reject: Discard emails that fail DMARC

3. Quarantine: Quarantine emails that fail DMARC

4. Head back to Cloudflare DNS and add your DMARC record, entering the following configurations.

Type: TXT

Name: _dmarc

Content: [paste the contents of your generated DMARC record]

TTL: Auto

Example: v=DMARC1; p=quarantine; rua=mailto:55ysaox6s3@rua.powerdmarc.com; ruf=mailto:55ysaox6s3@ruf.powerdmarc.com; pct=100;

5. Click on Save to save changes. Cloudflare may take some time to process these changes.

Editing and Deleting Cloudflare DMARC Records

To edit and delete DMARC record entries for Cloudflare or any DNS records on Cloudflare:

1. Login to Cloudflare

2. Select your account and domain

3. Select DNS > Records

4. Click on Edit to edit the record of your choice and then you can either continue to edit or click Delete to delete the record entry. Confirm your deletion by clicking on Delete again

5.Click on Save to save your changes

How to Add SPF Records to Cloudflare

To add an SPF record to your Cloudflare DNS, follow the steps below:

1. Log in to Cloudflare

2. Select your account and domain.

3. Navigate to DNS > Add Record.

4. Keep this page open and sign up with PowerDMARC for free to access our SPF record generator tool. Use this tool to create an SPF record and copy the record syntax.

Make sure you are authorizing all your legitimate email sending sources in your SPF record. You can also authorize your third-party email vendors (eg. SendGrid, Google, etc) using the “include” mechanism.

5. Head back to Cloudflare DNS and add your SPF record, entering the following configurations.

Type: TXT

Name: @

Content: [paste the contents of your generated SPF record]

TTL: Auto

Example: v=spf1 mx a include:sample.com include:authorized.source.com ~all

6. Click on Save to save changes. Cloudflare may take some time to process these changes

How to Add DKIM Records to Cloudflare

Note that if you are using third-party email vendors like Google, Microsoft, SendGrid, etc to send your emails, you won’t need to generate DKIM keys manually. You can get in touch with your ESP to learn about the steps to generate DKIM keys directly on the admin portal. You can also refer to our knowledge base for guidance.

However, if you need to generate your DKIM record, we recommend using our DKIM record generator tool for quick and instant record creation with accurate, error-free results!

To add a DKIM record to your Cloudflare DNS, follow the steps below:

7. Log in to Cloudflare

8. Select your account and domain.

9. Navigate to DNS > Add Record.

10. Add the DKIM public key by entering the following:

Type: TXT/CNAME (This field will have value “TXT” if you generate the record using PowerDMARC’s tool, else, it can be a “CNAME” or “TXT” type record depending on the value generated on your ESP’s portal.)

Name: (selector).domainkey.(yourdomain.com)

Content: [paste the contents of your generated DKIM public key or the one provided to you by your ESP]

TTL: Auto

Example: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo6qEWvbgBO969zJqeONDkVV8NPA6cz7Arb+E5CVS0PasNRyARAl4ek5FbGUPLqZziAmt8Tp0s4+hENz+feAfiDBnZL72GDsm4JVqJ9Ev08xvfwaY1dsz9cgFFkjb35bi5kug7Ht+adEICnMi5zJ/QyBA8cn3oChWpxx1sDHZsDOUIdwQqa59z7WR0nYlHs16egtZCkbc1mmglWdLw5dxIeCBkoFUsQ90b5dlnnAJkKRKkZh6pNXbbyJFaNYQjDAKGHMRNaUnx19kPc5vugEoGw4rlt5vw1QLs/xOX6bU4COXmLCfBFWdXBe8kqKMV2CnKnBszFjYe68deH3C+1XLVQIDAQAB

11. Click on Save to save changes. Cloudflare may take some time to process these changes.

Verifying DMARC, SPF, and DKIM Records on Cloudflare

Checking your Cloudflare DNS records is essential to ensuring they perform properly at authenticating your emails. You can do so by using the following DNS lookup tools from our portal:

Final Words

Enabling email authentication with DMARC, SPF, and DKIM can aid in your battle against brand impersonation. However, the benefits are only visible when done correctly. PowerDMARC automates setup processes, generates DNS records, and provides real-time monitoring and reporting of authentication status.

With policy enforcement capabilities and insights into email traffic, PowerDMARC enables organizations to enhance security, comply with regulations, and maintain a positive email reputation, ultimately protecting against phishing attacks and ensuring the authenticity of their communications.

Get your free DMARC trial today!

About
Latest Posts

Yunes Tarada

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.