Set Up a DMARC Record on Cloudflare
A DMARC record is a TXT record at _dmarc.yourdomain.com that tells inbox providers what to do with mail that fails SPF or DKIM, and where to send reports. This guide shows exactly where to add it in Cloudflare. For the background, read What Are SPF & DMARC?.
What you'll need
- A mailbox address to receive DMARC reports, for example
dmarc@yourdomain.com. - SPF and DKIM already set up for your sending domain. See SPF on Cloudflare and DKIM on Cloudflare. DMARC checks them, so it is only useful once they pass.
Step 1: Open your domain's DNS in Cloudflare
- Go to dash.cloudflare.com and sign in.
- Click the domain you send email from.
- In the left-hand menu, click DNS, then Records.
Step 2: Add the DMARC TXT record
- Click Add record and choose TXT as the type.
- In the Name field: Enter
_dmarconly. Cloudflare adds your domain to the end automatically, so typing_dmarc.yourdomain.comwould create the wrong record. - In the Content field: Paste
v=DMARC1; p=none; rua=mailto:you@yourdomain.com, using your own report address. - Leave TTL on Auto. TXT records are never proxied, so there is no orange-cloud setting to change.
- Click Save.
| Field | What to enter |
|---|---|
| Type | TXT |
| Name | _dmarc |
| Content | v=DMARC1; p=none; rua=mailto:you@yourdomain.com |
Start with p=none, then tighten
p=none only watches and reports. It is the safe way to start because it cannot block any of your own mail. After a few weeks of clean reports, move to p=quarantine (send failures to spam) and later p=reject (block them). Jumping straight to p=reject risks blocking legitimate mail if an SPF include is missing.
If you already have a DMARC record
A domain can only have one DMARC record. If Cloudflare already lists a TXT record at _dmarc, edit it instead of adding another.
Step 3: Check DMARC in Warmerly
Warmerly rechecks your domain's DNS automatically. DNS changes can take anywhere from a few minutes up to 24 to 48 hours to spread, so if the DMARC warning is still showing right after you save, check again later. You do not need a selector for DMARC, because it is one record at a fixed location.
Still stuck?
Back to the main guide: What Are SPF & DMARC?. The same click-path in Cloudflare is used for DKIM. To see what is live right now, use the free SPF checker or DMARC checker.
Summarize with AI