On this page

Fixing DMARC in Cloudflare

What this fixes

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM, and lets you receive reports about spoofing attempts against your domain. See Fixing DMARC Record Issues for what each tag means — this guide covers the Cloudflare-specific steps. Make sure SPF and DKIM are already set up first.

You'll need your domain added to Cloudflare as a zone, with Cloudflare set as (or delegated) your authoritative DNS.

How to fix it

  1. Log in to the Cloudflare dashboard and select your domain.
  2. Go to DNS → Records → Add record.
  3. Set Type to TXT.
  4. Name: _dmarc
  5. Content: paste your DMARC record, e.g. v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1.
  6. Set TTL to Auto. TXT records have no proxy toggle — Cloudflare's proxy (orange cloud) only applies to A/AAAA/CNAME records, so there's nothing to switch off here.
  7. Click Save.
  8. Re-run your scan to confirm.

If a _dmarc TXT record already exists, edit it rather than adding a second one — DMARC only reads the first record found.

Common pitfalls

  • Setting p=reject before verifying all legitimate senders (marketing tools, CRMs, etc.) pass SPF/DKIM — this can silently block real email. Start with p=none, review the rua reports, then move to quarantine and eventually reject.
  • Leaving out the fo= tag, which limits the detail in forensic reports.
  • Adding a second _dmarc TXT record instead of editing the existing one.