How to Add Cloudflare DMARC, SPF, and DKIM Records? Easy Setup Guide
by
Reading Time: 6 min
Cloudflare is one of the biggest content delivery network service providers in the world. Cloudflare can be used as your DNS host to add and edit DNS records for various operations. If you wish to enable DMARC, SPF, and DKIM for your domain, and your DNS hosting provider is Cloudflare – this guide is for you!
DMARC or Domain-based Message Authentication Reporting and Conformance is a protocol used to authenticate emails. Domains with DMARC implemented enjoy better security against spoofing, phishing, and impersonation attacks. DMARC also provides visibility into your email’s behavior and delivery channels.
SPF and DKIM are essential processes for email authentication which allows senders to authorize sending sources and make sure attackers in the middle do not alter email contents.
Let’s find out how you can set up SPF, DKIM, and DMARC for Cloudflare with a few easy steps.
Key Takeaways
- Cloudflare serves as an effective DNS host for implementing DMARC, SPF, and DKIM records to enhance email security.
- DMARC helps authenticate emails and provides visibility into email behavior, safeguarding against spoofing and phishing attacks.
- SPF and DKIM are essential for authorizing sending sources and ensuring email integrity.
- Accurate field configurations in your DMARC record are crucial to avoid erroneous setups that compromise security.
- Regularly verifying your DNS records ensures they function correctly and improve your email authentication process.
How to Add DMARC Record to Cloudflare
You can setup DMARC records in Cloudflare DNS by following these steps:
1. Log in to Cloudflare
2. Select your account and domain.
3. Navigate to DNS > Add Record.
4. Keep this page open and sign up with PowerDMARC for free to access our DMARC record generator tool. Use this tool to create a DMARC record and copy the record syntax.
Note that the v= (version) field and p= (policy) field are mandatory fields in your DMARC Cloudflare record. Omitting any of these two fields will lead to an erroneous record. The value for the v= tag is always DMARC1. Your DMARC policy can be either of the three options depending on how strictly you wish to handle messages that fail DMARC:
1. None: take no action and deliver all emails
2. Reject: Discard emails that fail DMARC
3. Quarantine: Quarantine emails that fail DMARC
4. Head back to Cloudflare DNS and add your DMARC record, entering the following configurations.
Type: TXT
Name: _dmarc
Content: [paste the contents of your generated DMARC record]
TTL: Auto
Example: v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100;
5. Click on Save to save changes. Cloudflare may take some time to process these changes.
Simplify DMARC, SPF, and DKIM Records with PowerDMARC!
Editing and Deleting Cloudflare DMARC Records
To edit and delete DMARC record entries for Cloudflare or any DNS records on Cloudflare:
1. Login to Cloudflare
2. Select your account and domain
3. Select DNS > Records
4. Click on Edit to edit the record of your choice and then you can either continue to edit or click Delete to delete the record entry. Confirm your deletion by clicking on Delete again
5.Click on Save to save your changes
How to Add SPF Records to Cloudflare
To add an SPF record to your Cloudflare DNS, follow the steps below:
1. Log in to Cloudflare
2. Select your account and domain.
3. Navigate to DNS > Add Record.
4. Keep this page open and sign up with PowerDMARC for free to access our SPF record generator tool. Use this tool to create an SPF record and copy the record syntax.
Make sure you are authorizing all your legitimate email sending sources in your SPF record. You can also authorize your third-party email vendors (eg. SendGrid, Google, etc) using the “include” mechanism.
5. Head back to Cloudflare DNS and add your SPF record, entering the following configurations.
Type: TXT
Name: @
Content: [paste the contents of your generated SPF record]
TTL: Auto
Example: v=spf1 mx a include:sample.com include:authorized.source.com ~all
6. Click on Save to save changes. Cloudflare may take some time to process these changes
How to Add DKIM Records to Cloudflare
Note that if you are using third-party email vendors like Google, Microsoft, SendGrid, etc to send your emails, you won’t need to generate DKIM keys manually. You can get in touch with your ESP to learn about the steps to generate DKIM keys directly on the admin portal. You can also refer to our knowledge base for guidance.
However, if you need to generate your DKIM record, we recommend using our DKIM record generator tool for quick and instant record creation with accurate, error-free results!
To add a DKIM record to your Cloudflare DNS, follow the steps below:
7. Log in to Cloudflare
8. Select your account and domain.
9. Navigate to DNS > Add Record.
10. Add the DKIM public key by entering the following:
Type: TXT/CNAME (This field will have value “TXT” if you generate the record using PowerDMARC’s tool, else, it can be a “CNAME” or “TXT” type record depending on the value generated on your ESP’s portal.)
Name: (selector).domainkey.(yourdomain.com)
Content: [paste the contents of your generated DKIM public key or the one provided to you by your ESP]
TTL: Auto
Example: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo6qEWvbgBO969zJqeONDkVV8NPA6cz7Arb+E5CVS0PasNRyARAl4ek5FbGUPLqZziAmt8Tp0s4+hENz+feAfiDBnZL72GDsm4JVqJ9Ev08xvfwaY1dsz9cgFFkjb35bi5kug7Ht+adEICnMi5zJ/QyBA8cn3oChWpxx1sDHZsDOUIdwQqa59z7WR0nYlHs16egtZCkbc1mmglWdLw5dxIeCBkoFUsQ90b5dlnnAJkKRKkZh6pNXbbyJFaNYQjDAKGHMRNaUnx19kPc5vugEoGw4rlt5vw1QLs/xOX6bU4COXmLCfBFWdXBe8kqKMV2CnKnBszFjYe68deH3C+1XLVQIDAQAB
11. Click on Save to save changes. Cloudflare may take some time to process these changes.
Verifying DMARC, SPF, and DKIM Records on Cloudflare
Checking your Cloudflare DNS records is essential to ensuring they perform properly at authenticating your emails. You can do so by using the following DNS lookup tools from our portal:
- Cloudflare DMARC record checker
- Cloudflare SPF record checker
- Cloudflare DKIM record checker
Final Words
Enabling email authentication with DMARC, SPF, and DKIM can aid in your battle against brand impersonation. However, the benefits are only visible when done correctly. PowerDMARC automates setup processes, generates DNS records, and provides real-time monitoring and reporting of authentication status.
With policy enforcement capabilities and insights into email traffic, PowerDMARC enables organizations to enhance security, comply with regulations, and maintain a positive email reputation, ultimately protecting against phishing attacks and ensuring the authenticity of their communications.
Get your free DMARC trial today!
Domain & Email Security Expert at PowerDMARC
Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.
Latest posts by Yunes Tarada (see all)
- Email Salting Attacks: How Hidden Text Bypasses Security - February 26, 2025
- SPF flattening: What is it and why do you need it? - February 26, 2025
- DMARC vs DKIM: Key Differences & How They Work Together - February 16, 2025
