Cloudflare DMARC: how to add a DMARC record
ChatGPT
Claude
Gemini
Perplexity
GrokIn brief
Cloudflare DMARC setup: enable DMARC Management or publish a TXT record, then validate DNS, a delivered message, and aggregate reports.
To add a DMARC record in Cloudflare, use Email > DMARC Management for an eligible apex domain that uses Cloudflare DNS, then enable reporting. Cloudflare can add its aggregate-report recipient to an existing DMARC record. If you need to publish the record yourself, add one TXT record at _dmarc.yourdomain.com, start with p=none, and validate DNS, a real delivered message, and report data before moving toward enforcement.
At a glance
Quick takeaways
- Cloudflare DMARC Management is available on Cloudflare plans for domains that use Cloudflare DNS.
- Cloudflare's enablement workflow is for apex domains and can add a Cloudflare
ruarecipient to an existing DMARC record. - DMARC needs an aligned SPF or DKIM pass to pass DMARC evaluation under RFC 9989.
- Start with
p=noneso aggregate reports can reveal legitimate sending services before enforcement. - A public DNS result does not prove that a production sender signs mail correctly or that a receiver will place a message in the inbox.
- Cloudflare says the first DMARC reports can take up to 24 hours after enablement.
Scope and prerequisites
Choose one apex domain and identify every production path that sends mail with that domain in the visible From header. This can include employee mail, marketing platforms, transactional applications, help desks, and security gateways. Record the DNS-zone owner, the person responsible for each sender, a test recipient, and the rollback owner before changing the record.
Cloudflare documents that DMARC Management requires Cloudflare DNS and supports apex domains. Confirm that the zone is active in the intended Cloudflare account. A domain delegated to another DNS provider cannot use this Cloudflare workflow until its authoritative DNS is on Cloudflare.
DMARC does not add SPF or DKIM authentication by itself. Under RFC 9989, the receiving system evaluates whether SPF or DKIM passed and whether the authenticated domain aligns with the visible From domain. Before raising a DMARC policy, collect evidence for each sender's SPF and DKIM configuration.
Your rollback condition is clear: if a legitimate production source begins failing DMARC after a policy change, return the policy to the previous known-good value while you investigate the sender. Do not remove the whole DMARC record as an improvised fix, because doing so also removes the reporting signal you need.
For broader DMARC implementation context, use the DMARC learning hub.
Choose the implementation approach
Use Cloudflare DMARC Management when the domain uses Cloudflare DNS and you want Cloudflare to collect and present aggregate-report data. The documented workflow can add Cloudflare's reporting address to an existing DMARC record rather than replacing the record outright.
Use a manually published TXT record when you need to control the report destination yourself or when Cloudflare DMARC Management is not eligible for the domain. The protocol record is the same DNS object in either case: one DMARC TXT record at the _dmarc label for the domain.
Cloudflare also provides an Email record overview for SPF, DKIM, DMARC, and BIMI records. Treat that view as DNS configuration analysis. It does not replace a delivered-message check from the exact sender you are changing.
How to configure DMARC Management in Cloudflare
1. Confirm the domain and its active senders
Open the Cloudflare account that owns the authoritative DNS zone. Confirm the exact apex domain before changing any record.
List the systems that send with the domain in the visible From header. A DMARC policy can affect mail from a sender that is not obvious from the DNS zone, such as an old marketing account or a billing platform. Keep this list with the change record.
2. Inspect existing email-authentication records
Open Email > DMARC Management and inspect the available email-record information. Cloudflare documents that its record overview analyzes SPF, DKIM, DMARC, and BIMI records.
Check whether _dmarc.yourdomain.com already has a TXT record. A domain should publish one DMARC policy record at that owner. Do not add a second independent DMARC TXT policy because receivers can treat multiple policy records as an error.
If an SPF warning appears, resolve that separately. Cloudflare documents the SPF DNS lookup limit and its warning behavior. An SPF record behind an external CNAME may not be editable through Cloudflare's workflow, so use the sender's or external DNS provider's documented change path.
3. Enable Cloudflare DMARC Management
In Cloudflare, open Email > DMARC Management for the eligible apex domain and follow the enablement flow. According to Cloudflare's enablement documentation, Cloudflare adds its aggregate-report recipient to an existing record when one is present.
Read the proposed record change before approving it. Preserve existing policy tags and report recipients unless you have confirmed that a replacement is intended. DMARC supports multiple aggregate-report addresses in the rua tag, separated by commas.
4. Publish a manual DMARC TXT record when needed
If you are publishing the policy manually, open DNS > Records, choose Add record, and select TXT. In a Cloudflare zone for yourdomain.com, use _dmarc as the record name if the interface appends the zone automatically.
Use this syntactically valid monitoring example only as a shape. Replace the report mailbox with an address your organization controls.
Do not overwrite an existing DMARC record without reviewing its policy, reporting addresses, and subdomain settings. Replacing an active record can interrupt reporting or change enforcement for mail already in production.
# Illustrative only. Do not publish this example unchanged.
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"The policy progression is p=none, then p=quarantine, then p=reject. Each move requires report evidence that legitimate sources pass and align. A DMARC pass supports message authentication, but it does not guarantee that a message is safe or will reach the inbox. Receivers retain policy discretion under RFC 9989.
5. Save the change and wait for report collection
Save the record or complete Cloudflare's enablement flow. Cloudflare states that its first DMARC reports can take up to 24 hours. This delay is separate from DNS visibility. A resolver may see the TXT record before Cloudflare has report data to display.
How to validate the setup
Validate the DMARC configuration at four layers. Each layer answers a different question.
- DNS: Query the authoritative DNS server and at least one public resolver for
_dmarc.yourdomain.com. Confirm that there is one intended DMARC policy record and that its value matches the approved change.
dig +short TXT _dmarc.yourdomain.com- Cloudflare: Confirm that Cloudflare DMARC Management shows the intended domain and record state. If you enabled Cloudflare reporting, wait for the documented report-collection period before treating an empty statistics view as a failure.
- Message: Send a new message through each production sender. Inspect the receiver-added
Authentication-Resultsfield from a trusted receiver. RFC 8601 explains that these results have a trust boundary, so do not treat a copied header from an untrusted source as proof. - DMARC reports: Review aggregate reports over enough normal sending activity to cover each known source. Cloudflare documents statistics views with daily reports, top sources, source detail, and selected periods up to 30 days.
Troubleshooting
Cloudflare DMARC Management is unavailable
Confirm that the domain is an apex domain using Cloudflare DNS. Then confirm that you are in the correct Cloudflare account and zone. Cloudflare's documented eligibility is tied to Cloudflare DNS, not merely to having a Cloudflare account.
The DMARC record is missing in a public lookup
Query _dmarc.yourdomain.com, not the root domain. Compare the full TXT answer with the intended value and check for a duplicated zone suffix, such as _dmarc.yourdomain.com.yourdomain.com.
Use the DMARC checker to inspect the public record after saving. The checker sees public DNS only. It cannot confirm a sender's live configuration, future DNS state, or a receiver's private delivery decision.
Cloudflare reports show an unfamiliar sending source
Start with the source details in Cloudflare's statistics view, then compare the IP address, organizational domain, visible From domain, and authentication outcomes with your sender inventory. Do not authorize a source only because it appears in a report. Identify the system owner and confirm whether it is expected before changing SPF, DKIM, or DMARC policy.
SPF has a lookup-limit warning
Cloudflare documents that SPF processing has a 10 DNS lookup limit. Find the mechanisms and included records that contribute to the count. If the SPF record delegates through an external CNAME, use the owner of that external record to make the correction rather than attempting an unsupported Cloudflare edit.
A legitimate sender fails DMARC after policy enforcement
Compare the message's visible From domain with the SPF smtp.mailfrom domain and the DKIM d= domain. An SPF or DKIM pass that does not align with the visible From domain does not create an aligned DMARC pass. Restore the previous policy only if production mail is affected, then fix the sender's authentication configuration before trying the next policy stage again.
Check the DMARC record before changing policy
Check the published record after enabling Cloudflare DMARC Management or editing the TXT value. Compare the result with the record you approved, then use aggregate reports and delivered-message evidence before moving beyond p=none.
A public record check cannot show every production sender, repair SPF or DKIM alignment, monitor later DNS drift, or prove how a receiver will handle an individual message.
If your team manages many domains, Cloudflare's domain-level reporting may leave a workflow gap: finding sources is different from tracking remediation across a portfolio. This is an operational inference based on Cloudflare's documented domain reporting and Palisade's documented Domain Overview, which includes DMARC Agent tickets and sender review states. Palisade is AI-first, agent-first DMARC software that analyzes aggregate-report data, identifies authentication and alignment issues, and creates prioritized remediation tickets. A human reviews the evidence and applies DNS or policy changes.
Palisade does not autonomously change your DMARC policy, prove every future message will authenticate, or control a mailbox provider's delivery decision.
Evidence
Sources and further reading
Questions readers ask
Frequently asked questions
Written by
Samuel ChenardCEO & Co-Founder, Palisade
Samuel Chenard is the CEO and co-founder of Palisade, AI-first DMARC software for IT teams and MSPs, from one domain to thousands.
More from Samuel →
