How to safely delegate DMARC records via CNAME without modifying your root zone

22 October 2026

“Root zone” here means your apex mail and web records—not the DNS root. Hosted DMARC never asks you to move MX, SPF, or website A/AAAA records. You replace only the DMARC TXT at _dmarc with one CNAME.

What you publish

Type	Name / host	Value / points to	Note
`CNAME`	`_dmarc.brand.example`	`brand.example._dmarc.hosted.senderidentity.com`	DNS only on Cloudflare. Remove any TXT at the same name.

What you do not change

Apex or subdomain SPF TXT records.
MX hosts for inbound mail.
Website or CDN records at the apex or www.

Safe sequence

Run the free audit and save the current DMARC text if you self-host today.
Subscribe and add the domain in Account so the hosted target and report mailbox exist.
Delete the TXT at _dmarc, publish only the CNAME (DNS only on Cloudflare).
Confirm delegation ready in Account. We publish p=none with rua at reports.senderidentity.com.
Read aggregate-derived senders, then approve quarantine stages and eventually p=reject—each step needs a person.

Cloudflare operators: follow DNS-only proxy mode. Provider-specific host fields: Quickstarts.