Do I have to remove my old DMARC record before editing it?

No — edit it in place. Deleting and re-adding risks a window with no policy at all, and if you forget to delete the original you end up with the duplicate-record problem above. Open the existing dmarc TXT record in Cloudflare, change the content, and save. There should only ever be one.

Can I set a different DMARC policy for a subdomain?

Yes. Add a separate TXT record with the Name field set to dmarc.subdomain (Cloudflare appends the zone to make dmarc.subdomain.example.com). A subdomain with no record of its own inherits the organizational domain's policy, so you only need a dedicated record when you want different handling — for example, enforcing reject at the root while a marketing subdomain stays at none during testing.

Will publishing DMARC break my existing email?

At p=none, no. The monitoring policy takes no action on any message; it only generates reports. Delivery is unaffected until you deliberately move to quarantine or reject — and even then, only mail that fails both SPF and DKIM alignment is touched. That is exactly why you read the reports first: to confirm your real senders pass before you enforce.

I send from several providers. Does that change how I add the record?

The DMARC record itself is the same regardless of how many senders you have. What changes is the prep: every provider — your mailbox host, transactional platforms, marketing tools — must be listed in your SPF record and sign with DKIM. If alignment breaks for one sender, the SPF alignment guide walks through the fix. DMARC needs only one of SPF or DKIM to pass and align per message.

Is a TXT record the same thing people mean by a "DMARC record"?

Yes. There is no separate DMARC record type in DNS. A DMARC record is simply a TXT record published at the dmarc host whose content begins with v=DMARC1. That is why Cloudflare has no "DMARC" option in the Type dropdown — you always choose TXT.

How can I add a DMARC record in Cloudflare?

To add a DMARC record in Cloudflare, open your domain, go to DNS > Records, click Add record, set the type to TXT, enter _dmarc as the name, and paste your DMARC policy string (starting with v=DMARC1) into the content field. Cloudflare publishes it within minutes. That is the whole job in one sentence — the rest of this guide walks through each step, the exact values to use, and the mistakes that trip people up.

Adding DMARC protects your domain from email spoofing and improves deliverability, because major mailbox providers now expect any domain sending real volume to publish one. Because Cloudflare hosts your DNS, the record lives right alongside your existing SPF and DKIM records.

Six-step flow for adding a DMARC record in Cloudflare, from generating the TXT string to moving from p=none to enforcement.

The full Cloudflare setup flow, condensed from the steps below.

Before you start

DMARC does not authenticate mail on its own. It reads the results of SPF and DKIM and checks that the domain they authenticated aligns with the domain a recipient actually sees in the From: header. So before you publish DMARC, confirm you already have:

A valid SPF record listing every service that sends mail as your domain. Check it with the SPF checker.
DKIM signing enabled on each of those sending services. Confirm signatures with the DKIM tool.

If SPF or DKIM is missing or broken, DMARC will still install fine at p=none — it just will not protect anything until those two pass and align. For the full picture of how the three records fit together, see what are DMARC, DKIM, and SPF.

Step 1: Generate your DMARC record string

A DMARC record is a short line of tag-value pairs. The safe starting record looks like this:

Technical exampletext

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Each tag has a job:

v=DMARC1 — the version tag. It must come first and must be exactly this value, or receivers ignore the record.
p= — the policy. It takes one of three values: none (monitor only, take no action), quarantine (send failing mail to spam), or reject (refuse failing mail outright). Always start at p=none.
rua=mailto:... — the address that receives daily aggregate (RUA) reports. This is how you discover every source sending mail as your domain.
ruf=mailto:... — optional. Requests forensic/failure (RUF) reports, which are per-message samples. Support is patchy across receivers, so most of the useful data comes from RUA.

Rather than hand-write the syntax, generate it with the DMARC record generator: enter your domain, pick a policy, and copy the exact TXT string it produces. Keep the policy at none for now — you will tighten it later, once reports confirm your legitimate senders pass.

Step 2: Open DNS Records in Cloudflare

Log in to the Cloudflare dashboard at dash.cloudflare.com.
On the account home screen, select the domain (zone) you want to protect. Each domain has its own DNS.
In the left-hand menu, choose DNS, then Records. You will see the full list of records Cloudflare hosts for the domain — your existing A, MX, and TXT entries live here.

Cloudflare DNS records table with search, filters, columns, and the Add record control. — Source: Cloudflare changelog, “New DNS records UX is rolling out”, checked July 29, 2026. First-party public interface excerpt, unmodified. Open the full-size screenshot.

Step 3: Add the TXT record

Click Add record and fill in three fields:

Type: choose TXT. There is no dedicated "DMARC" record type anywhere in DNS — DMARC is always published as a plain TXT record.
Name: enter _dmarc — just that, nothing more. Cloudflare automatically appends your zone name, so _dmarc becomes _dmarc.example.com. Do not type the full _dmarc.example.com, or you will end up with a broken _dmarc.example.com.example.com host.
Content: paste the DMARC string you generated in Step 1, for example v=DMARC1; p=none; rua=mailto:dmarc@example.com.

Leave TTL on Auto. DMARC records are never proxied, so there is no orange-cloud toggle to worry about here — the proxy only applies to A, AAAA, and CNAME records that route web traffic, not to TXT records. Click Save. Example DMARC TXT records showing the _dmarc host name with a p=none policy on the main domain and a subdomain variant.

Example DMARC TXT records showing the _dmarc host name with a p=none policy on the main domain and a subdomain variant.

Example values only — paste the exact DMARC string you generated for your domain.

Cloudflare responsive DNS record editor showing the record fields and save controls. — Source: Cloudflare changelog, “New DNS records UX is rolling out”, checked July 29, 2026. First-party public interface excerpt, unmodified. Open the full-size screenshot.

Step 4: Verify the record is live

Cloudflare usually publishes DNS changes within a minute or two. Confirm the record resolved correctly with the DMARC checker — enter your domain and it returns the published policy. If you prefer the command line, run:

Technical exampletext

dig TXT _dmarc.example.com +short

The response should exactly match the string you pasted. A broader DNS lookup is handy if you want to see the record in context with the rest of the zone, and the Email Security Score shows SPF, DKIM, and DMARC together in one report.

Step 5: Read reports, then tighten the policy

Leave the policy at p=none for at least one full billing or sending cycle — typically two to four weeks. During that window the addresses in your rua= tag collect daily aggregate reports listing every source sending mail under your domain, with pass and fail counts. Those reports are the entire reason to start at none: they reveal forgotten senders (a helpdesk, a billing platform, a marketing tool) that still need SPF or DKIM fixed.

Once every legitimate source passes SPF or DKIM and aligns, edit the same _dmarc TXT record and step the policy up — none → quarantine → reject. Never jump straight to reject, and change one thing at a time so a report cycle can confirm nothing broke. For the safe rollout sequence, see how to create a DMARC record, and for choosing your enforcement level, reject vs quarantine.

A note on Cloudflare DMARC Management

If you would rather not read raw XML, Cloudflare offers a built-in DMARC Management feature under Email > DMARC Management in the dashboard. It is free for any domain using Cloudflare DNS, sets your rua address to a Cloudflare endpoint, and parses the reports into a plain-language view of your top sending sources and record status. It is optional — a manually added _dmarc TXT record works identically — but it removes the report-reading step for teams that want it.

Common issues with DMARC records in Cloudflare

My record still shows as missing after I added it

DNS changes on Cloudflare normally appear within minutes, but resolver and browser caches can lag. First re-check with the DMARC checker rather than your mail client. If it still shows missing, confirm you saved the record under the correct zone and that the type is TXT, not SPF or another type. Give it up to an hour for older cached lookups to expire, then verify again with dig.

I get a "duplicate DMARC record" error

Only one DMARC TXT record is allowed per _dmarc host. If a second one exists — often left behind by a mail provider's setup wizard or a previous attempt — receivers treat the policy as undefined and skip enforcement entirely. In the DNS Records list, filter for _dmarc, delete the extra entry, and edit the remaining record instead of adding another. If you genuinely need different rules per subdomain, that is a separate record at _dmarc.subdomain.example.com, not a second one at the root.

Cloudflare turned my host into `_dmarc._dmarc.example.com`

This is the most common Cloudflare-specific mistake. Cloudflare auto-appends the zone name to whatever you type in the Name field, so entering the full _dmarc.example.com produces _dmarc.example.com.example.com, and entering _dmarc. variants can double up the label. Edit the record and set the Name field to just _dmarc — nothing else. The list view will still display the full _dmarc.example.com, which is correct.

My DMARC reports never arrive

If your rua= address is on a different domain than the one publishing DMARC (for example, DMARC on example.com but reports going to reports@vendor.com), the receiving domain must publish an authorization record confirming it accepts your reports. Without it, receivers silently drop the reports. See why am I seeing an external verification failure in my DMARC reports and how can I fix it for the exact record to add. Sending reports to an address on the same domain avoids this entirely.