Email DNS records: MX, SPF, DKIM and DMARC
MX records say where your email is delivered. SPF, DKIM and DMARC are TXT records that prove mail really comes from your domain. Your email provider gives you the values; we add them to Cloudflare for you through a ticket.
Applies to: Cloudflare
On this page
Four kinds of DNS record keep your email working. MX records tell other mail servers where to deliver mail for your domain. SPF, DKIM and DMARC are TXT records that let receiving servers check that mail claiming to be from your domain is genuine, which keeps your messages out of spam folders and makes your domain harder to fake. Your email provider gives you the values; for domains on Oogle hosting, we add them to Cloudflare when you send them in a ticket.
What each record does
| Record | Type | What it does |
|---|---|---|
| MX | MX | Names the servers that receive mail for your domain |
| SPF | TXT on the domain, starts v=spf1 | Lists which servers may send mail as your domain |
| DKIM | TXT (sometimes CNAME) on a name your provider gives you | Publishes a key that checks each message's signature |
| DMARC | TXT on _dmarc, starts v=DMARC1 | Says what receivers should do when SPF and DKIM fail, and where to send reports |
MX
MX records have a priority number. Lower numbers are tried first, and higher ones are backups. Use exactly the servers and priorities your email provider lists. If the MX records are wrong or missing, mail to your domain bounces or disappears.
SPF
SPF is one TXT record that lists every service allowed to send mail as your domain: your mailbox provider, plus perhaps a newsletter tool, a booking system or a website form. It must be a single record. When a new service asks you to "add SPF", it usually means adding its part to the existing record, not creating a second one.
DKIM
DKIM signs each outgoing message. Your provider generates a key and gives you a record name (often something like selector._domainkey) and a long value. Some providers use CNAME records instead, so they can rotate keys for you. Copy the name and value exactly.
DMARC
DMARC ties SPF and DKIM together. It tells receivers whether to accept, quarantine or reject mail that fails, and can send you reports. Most domains start with a monitoring policy and tighten it once everything passes.
Mail records and Cloudflare
MX and TXT records are always DNS only in Cloudflare. The hostname an MX record points to must also be DNS only (grey cloud), because mail doesn't pass through Cloudflare's proxy. See Proxied or DNS only.
When we set your domain up on Cloudflare, we check the mail records by hand, because Cloudflare's automatic scan can miss some. Mail records get extra care because a mistake can stop your email.
Ask us to add or change email records
- Open your email provider's DNS setup page and keep it open.
- Open a Website Support ticket.
- In Summary, write something like "Add email DNS records for example.com".
- In Details, name your email provider and paste each record: type, name, value and, for MX, priority.
- Say whether the new records replace old ones (for example, when you're moving to a new email provider) or add to them.
- Select Open Ticket.
These values aren't secret, so they're safe to paste. Never include an email password. More on what to include: How to ask us to change a DNS record.
Check your records
dig mx example.com +short
dig txt example.com +short
dig txt _dmarc.example.com +shortReplace example.com with your domain. The first line should list your provider's mail servers, the second should include exactly one line starting v=spf1, and the third should start v=DMARC1. Without a command line, enter each name at Google Public DNS, select Resolve, and choose MX or TXT. Many email providers also have a "verify" button on their DNS setup page.
You'll know it worked when
Your email provider's setup page shows the domain as verified, mail arrives and sends normally, and a message you send to an outside address shows SPF, DKIM and DMARC as passing in its full headers (most webmail services have a "show original" option).
Troubleshooting
- Mail stopped arriving after a change. Check the MX records first. If they're wrong, tell us straight away in a ticket and choose a higher Priority.
- Messages land in spam. SPF or DKIM is often missing for one sending service, such as a website form or newsletter tool. See Email not arriving or going to spam.
- Two SPF records. Receivers treat this as an error. Ask us to merge them.
- A DKIM record is "not found". The name may have been entered with your domain repeated at the end. Check the exact name your provider shows.
- DMARC reports arrive and look alarming. They're often routine. Ask your email provider how to read them.
Next steps
- Change DNS without taking your website or email offline
- DNS records explained
Frequently asked questions
Who gives me the values for these records?
Your email provider, for example the company that hosts your mailboxes or the service that sends your newsletters. Their setup pages list the exact records.
Can I have two SPF records?
No. A domain must have one SPF record. If two services each tell you to add one, they have to be combined into a single record. We'll do that for you.
Should my mail records be proxied by Cloudflare?
No. MX and TXT records are always DNS only, and the hostname an MX record points to must be DNS only too, because email doesn't pass through Cloudflare's proxy.
What DMARC policy should I use?
Start by monitoring (a policy of none) and move to stricter settings once you're sure every service that sends as your domain passes SPF or DKIM. Your email provider's guidance comes first.