--- title: "Cloudflare DMARC monitoring: how to enable and validate it" description: "Cloudflare DMARC monitoring helps apex-domain owners receive and review DMARC reports. Enable it safely, review records, and validate report data." canonical: https://www.palisade.email/learning/cloudflare-dmarc-monitoring last-updated: 2026-11-11 --- # Cloudflare DMARC monitoring: how to enable and validate it > Cloudflare DMARC monitoring helps apex-domain owners receive and review DMARC reports. Enable it safely, review records, and validate report data. Cloudflare DMARC monitoring is enabled in the Cloudflare dashboard under **Email > DMARC Management > Enable DMARC Management** for an apex domain using Cloudflare DNS. Cloudflare can add a DMARC record when none exists or add its own aggregate-report recipient to an existing record, then display report information after reports begin arriving. The Cloudflare-generated reporting address is account-specific, so copy it only from the domain and account you are configuring. ## Quick takeaways - [Cloudflare DMARC Management](https://developers.cloudflare.com/dmarc-management/) is available to Cloudflare customers with Cloudflare DNS on all plans. - Cloudflare DMARC Management works with apex domains, not domains in subdomain setups. - If the domain has no DMARC record, Cloudflare offers an **Add** action during enablement. - If a DMARC record already exists, Cloudflare adds another `rua` recipient so it can receive aggregate reports. - Cloudflare says the first report and displayed information can take up to 24 hours after activation. - A Cloudflare activation status does not prove that every production sender passes SPF, DKIM, or DMARC. ## What should I check before configuring Cloudflare? Confirm that the domain is an apex domain in a Cloudflare DNS zone and that you can select the correct Cloudflare account and domain. Cloudflare documents that DMARC Management only works with apex domains, not subdomain setups. Check that the domain is actually using Cloudflare DNS before starting, because Cloudflare describes DMARC Management as available to customers with Cloudflare DNS. This workflow enables report processing for the selected domain. It does not configure every sender that uses the domain. Employee mail, a marketing platform, transactional mail, and a support platform can use different SPF, DKIM, and return-path settings. The [ESP setup guides](/learning/esp-setup) can help separate those sending paths before you change a DMARC record. You need permission to access the correct Cloudflare account, select the zone, and approve DNS changes. Confirm who owns the existing DMARC record and who receives the reports today. An existing record can contain recipients used by another team or monitoring service. > Copy DNS values from the account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example. Cloudflare documents one important DNS limitation: DMARC Management cannot modify SPF records when a CNAME in the zone points to an external domain. In that case, manage SPF through the DNS provider for the external domain rather than attempting an SPF update in Cloudflare. ## Which setup method should I use? Use Cloudflare DMARC Management when the apex domain uses Cloudflare DNS and you want Cloudflare to receive and process aggregate DMARC reports. Cloudflare's documented enablement flow handles two record states: it can offer to add a DMARC record when none is found, or it can add a Cloudflare `rua` recipient to an existing record. If an existing DMARC record is already managed through a controlled DNS change process, inspect the proposed update before approving it. The Cloudflare reporting destination is generated for the account and domain. Do not replace existing `rua` recipients just because Cloudflare adds another one. The documented dashboard path is: ```text Cloudflare dashboard > select account > select domain > Email > DMARC Management > Enable DMARC Management ``` ![Cloudflare DMARC Management workflow from activation to report review](/images/editorial/cloudflare-dmarc-monitoring/cloudflare-dmarc-monitoring-flow.webp "1200x829") *Source: Palisade.* ## How do I configure DMARC Management in Cloudflare? Cloudflare DMARC Management is a DMARC-report workflow. Cloudflare's record overview can present SPF, DKIM, and DMARC records, but enabling DMARC Management does not establish that each sending service has correct SPF or DKIM authentication. Keep sender-specific authentication work separate from report enablement. ### 1. Open DMARC Management Sign in to Cloudflare, select the correct account and apex domain, then open **Email > DMARC Management**. Cloudflare's [enablement documentation](https://developers.cloudflare.com/dmarc-management/enable/) identifies this as the current path. Check the zone name before selecting an action. A Cloudflare account can contain several zones with similar names, and DMARC Management applies to the selected apex domain. ![Cloudflare DMARC Management enablement decision from eligibility to active status](/images/editorial/cloudflare-dmarc-monitoring/cloudflare-dmarc-monitoring-enable-flow.webp "1200x829") *Source: Palisade.* ### 2. Confirm the domain is eligible Confirm that the selected domain is an apex domain rather than a subdomain setup. Cloudflare states that DMARC Management works only with apex domains. If the feature is unavailable, stop before changing DNS. Check the selected zone, the account, and whether Cloudflare DNS is in use. Do not try to reproduce the workflow by copying a reporting recipient from another Cloudflare account. ### 3. Review the DMARC record branch Cloudflare checks whether the selected domain already has a DMARC record. If Cloudflare finds no record, its documented flow offers **Add**. If it finds an existing record, Cloudflare states that it adds another `rua` entry using a Cloudflare email address so Cloudflare can receive and process aggregate reports. Treat the Cloudflare-generated recipient as account-specific. The structural example below shows where a reporting destination belongs. It is illustrative only and is not a Cloudflare value. **Record type:** `TXT` **Host (illustrative only):** ```text _dmarc ``` **Value shape (illustrative only):** ```text existing DMARC policy; rua=mailto: ``` ![Illustrative DMARC TXT record with an existing reporting address and a placeholder for a Cloudflare-generated recipient](/images/editorial/cloudflare-dmarc-monitoring/cloudflare-dmarc-monitoring-records.webp "1200x400") *Source: Palisade. Placeholder values only; the policy shown is an example and not what Cloudflare will propose for your domain.* > Do not publish this example. Copy the exact proposed change from the Cloudflare account and selected domain. Do not remove existing report recipients unless the domain owner has approved that change. Some DNS providers automatically append the zone name to the host field. If a DNS interface expects only `_dmarc`, entering a fully qualified owner can create a duplicated domain name. Review the final owner name before saving. ### 4. Enable DMARC Management Select **Enable DMARC Management** and review the record action Cloudflare presents. Cloudflare describes the feature as beta and states that it becomes active after the enablement flow completes. Do not treat activation as proof of sender authentication. Activation confirms that the Cloudflare workflow was enabled for the selected domain. It does not prove that a marketing platform signs with an aligned DKIM domain or that a transactional sender uses an aligned SPF return path. ### 5. Send a real test message Send a new message through each important production path that uses the visible From domain. Include the paths that matter to the domain's DMARC posture, such as employee mail, marketing messages, transactional messages, and customer-support mail. Inspect the raw message at a receiving mailbox where headers are available. Cloudflare report processing can identify trends after reports arrive, but a real message is the immediate check for the route you just tested. ## How does this setup affect DMARC? Cloudflare DMARC Management receives and processes aggregate-report data. Cloudflare says the feature helps customers track sending sources and review SPF, DKIM, and DMARC pass or fail information. This is useful after a domain has a published DMARC record, but it does not change the protocol rule that a sender must pass DMARC through aligned SPF or aligned DKIM. Use the [DMARC learning hub](/learning/dmarc) for the protocol and policy concepts behind the record. Before relying on Cloudflare's report view, use Palisade's [DMARC checker](/tools/dmarc) to inspect the publicly visible DMARC record. A public DNS result can show the record currently published for the queried domain. It cannot prove which production sources are sending, whether a receiver accepted a message, whether Cloudflare has received every aggregate report, or how future messages will be handled. ## How do I validate the setup? ### Check public DNS Inspect the published DMARC record through the authoritative DNS path and at least one public resolver. Confirm that the expected record exists and that the report-recipient change shown in Cloudflare is present. If the record is missing or differs from the intended value, compare the owner name and complete TXT content in DNS with the Cloudflare record view. Do not edit SPF records as part of this check unless the evidence points to an SPF-specific issue and the DNS ownership path is clear. ### Check the Cloudflare vendor status Return to **Email > DMARC Management** and confirm that Cloudflare shows DMARC Management as active for the same domain. Then open **Email record overview > View records**. Cloudflare documents that this view provides options for SPF, DKIM, and DMARC records and lists previous records. A green or active vendor status proves only that Cloudflare accepted the selected workflow. It is not a delivered-message check. ### Inspect a delivered message Inspect a new message sent through the production route under review. Look for the receiver's trusted `Authentication-Results` field and compare the visible From domain with the SPF and DKIM results. [RFC 8601 defines Authentication-Results and its trust boundary](https://datatracker.ietf.org/doc/html/rfc8601). Keep a redacted copy of the headers with the change record. Remove recipient addresses, message content, internal hostnames, and other sensitive data before sharing it. ### Review DMARC reports Cloudflare says that the first report and displayed information can take up to 24 hours. After that period, review the report information for the selected domain and separate legitimate sources from sources that need investigation. Cloudflare's report display does not establish that every sender is configured correctly. Use the reports to identify sources and authentication outcomes, then investigate each sender through its own configuration and delivered-message evidence. ## Troubleshooting ### Cloudflare does not show Enable DMARC Management Confirm that you selected the correct account and apex domain. Cloudflare documents that DMARC Management requires Cloudflare DNS and does not work for domains in subdomain setups. ### Cloudflare offers to add a DMARC record Cloudflare offers **Add** when it does not find a DMARC record. Review the proposed DNS action before approving it. If your organization already manages DMARC through another DNS workflow, confirm that you are viewing the correct zone before creating a second record path. ### An existing DMARC record changes unexpectedly Cloudflare documents that it adds another `rua` entry when a DMARC record exists. Compare the complete existing value with the proposed value and verify that existing report recipients remain present. Do not delete a recipient without confirming its owner and purpose. ### SPF cannot be modified in Cloudflare Cloudflare documents that DMARC Management cannot modify SPF records when a zone CNAME points to an external domain. Manage the SPF change through the external domain's DNS provider. This limitation does not show that SPF is failing. Confirm the sending path and DNS ownership before making a change. ### No report information appears yet Cloudflare says first-report information can take up to 24 hours after activation. Confirm that DMARC Management is active and that the published DMARC record includes the Cloudflare reporting recipient shown for the selected account. If the period has not elapsed, wait before treating the absence of data as a configuration failure. ## Check the published DMARC record before relying on report data Cloudflare DMARC Management can process aggregate reports after the selected apex domain is enabled, but the public DMARC record still needs to match the intended DNS state. Run the domain through Palisade's DMARC checker, then compare its result with the record shown in Cloudflare and the raw headers from a real production message. [Check the DMARC record](/tools/dmarc) A public record check cannot prove that Cloudflare has received reports, identify every production sender, repair a failing source, or guarantee future message delivery. Palisade is agentic DMARC software that analyzes aggregate-report data, identifies sending sources and authentication or alignment issues, and creates prioritized remediation tickets. A human reviews the evidence and applies any policy change. [Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=cloudflare-dmarc-monitoring) ## Sources and further reading - [Cloudflare DMARC Management overview](https://developers.cloudflare.com/dmarc-management/) - [Cloudflare DMARC Management enablement instructions](https://developers.cloudflare.com/dmarc-management/enable/) - [Cloudflare email security record overview](https://developers.cloudflare.com/dmarc-management/security-records/) - [RFC 8601: Authentication-Results](https://datatracker.ietf.org/doc/html/rfc8601) ## Frequently asked questions ### Is Cloudflare DMARC Management available on all plans? Yes. Cloudflare states that DMARC Management is available on all plans for Cloudflare customers with Cloudflare DNS. ### Can Cloudflare DMARC Management monitor a subdomain setup? No. Cloudflare states that DMARC Management works with apex domains and not domains in subdomain setups. ### Does Cloudflare DMARC Management replace an existing DMARC record? No. Cloudflare documents that, when it finds an existing DMARC record, it adds another `rua` entry so Cloudflare can receive and process aggregate reports. Review the full proposed record before approving it. ### How long does Cloudflare take to show the first DMARC report? Cloudflare says that the first report and displayed information may take up to 24 hours after DMARC Management is enabled. ### Does an active Cloudflare DMARC Management status prove DMARC passes? No. An active Cloudflare status confirms that the feature is enabled for the selected domain. Inspect a delivered production message and review report data to determine whether each sending path passes authentication and DMARC.