My email platform says DKIM verification failed, but the records look right in Cloudflare.

Nine times out of ten the DKIM CNAME is still Proxied (orange cloud). Edit the record, set proxy status to DNS only, and re-run the platform's verification. The record list shows a grey cloud icon when it's correct.

Does Cloudflare's email routing feature conflict with these records?

Cloudflare Email Routing manages MX and adds its own SPF include for forwarding. It coexists with your sending records, but if you enable it, make sure your SPF record keeps your sending platform's include alongside Cloudflare's — one merged record, not two.

Should the SPF or DMARC TXT records be proxied?

TXT records can't be proxied — the toggle only exists on A, AAAA, and CNAME records. If you're being offered a proxy toggle, you're adding the wrong record type.

How to add SPF, DKIM and DMARC records in Cloudflare

Cloudflare's DNS editor is fast and free, but it has one email-specific trap: CNAME records default to Proxied, and a proxied DKIM CNAME is invisible to mail servers. Here's the full setup — SPF, DKIM, DMARC — with the proxy switch handled correctly.

Updated July 25, 2026

Where DNS lives in Cloudflare

Sign in at dash.cloudflare.com and select the domain (Cloudflare calls it a zone).
Open DNS → Records in the left sidebar.
Click Add record for each record below.

Add the SPF record

One TXT record at the root. In Cloudflare, Name @ means the root of the zone. The include: value comes from your email platform — our setup guides list it for every major provider. TXT records have no proxy toggle, so nothing to get wrong here.

v=spf1 include:spf.protection.outlook.com -all

Add record → Type: TXT, Name: @, Content (example for Microsoft 365):

Paste the value without quotes — Cloudflare handles quoting itself. And check the existing records list first: if a v=spf1 TXT already exists, merge into it, because a domain gets exactly one SPF record.

Add DKIM — and turn the proxy off

Copy the DKIM records from your sending platform (how to enable DKIM). If they're TXT records, add them normally. If they're CNAME records — SendGrid, Microsoft 365, Klaviyo, and most ESPs use CNAMEs — you must set the proxy status to DNS only (grey cloud) when adding them.

Add the DMARC record

A TXT record at the _dmarc host. Cloudflare also offers a guided Email Security wizard that can insert SPF/DMARC records, but adding the record directly keeps you in control of the value — build it with our DMARC generator.

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Add record → Type: TXT, Name: _dmarc, Content:

Verify it worked

Cloudflare propagates in seconds to minutes — fastest of the major DNS hosts. Run the email health check to confirm all three records resolve, and use the DKIM checker with your selector to confirm the CNAME chain resolves end to end (this is the check that catches a still-proxied record).