Cloudflare: publish mail authentication without proxying _dmarc.

22 October 2026

Cloudflare’s proxy (orange cloud) is for HTTP. Mail authentication records must stay DNS-only. A proxied CNAME at _dmarc will not deliver a usable DMARC TXT to receivers.

Add or edit records

Open the domain → DNS → Records.
For SPF: type TXT, name @ (or the subdomain), content starting with v=spf1. Keep a single SPF TXT on that name.
For DKIM: usually type CNAME or TXT at <selector>._domainkey, values copied from Google, Microsoft, SendGrid, SES, and so on.
For DMARC: type TXT at _dmarc, or—if you use Hosted DMARC—type CNAME at _dmarc and set Proxy status to DNS only.

Example: Hosted DMARC CNAME

Type	Name / host	Value / points to	Note
`CNAME`	`_dmarc.brand.example`	`brand.example._dmarc.hosted.senderidentity.com`	DNS only on Cloudflare. Remove any TXT at the same name.

Cloudflare sometimes shows the name without the zone suffix. Entering _dmarc is enough when the zone is brand.example.

Dedicated walkthrough: Hosted DMARC CNAME on Cloudflare (DNS-only).

Hosted DMARC on this provider

If you use Sender Identity Hosted DMARC, delete the TXT at _dmarc and publish only this CNAME. We publish the DMARC TXT on our side, starting at p=none with rua at reports.senderidentity.com.

Type	Name / host	Value / points to	Note
`CNAME`	`_dmarc.brand.example`	`brand.example._dmarc.hosted.senderidentity.com`	DNS only on Cloudflare. Remove any TXT at the same name.

After the CNAME resolves, open Account on the site, confirm delegation shows ready, and keep reading aggregate reports before you approve quarantine or reject.

Check the result

Wait for DNS TTL (often 5 minutes to an hour).
Run the free static audit on the domain.
Confirm the DMARC check shows the policy you expect, and that a CNAME path is not blocked by a leftover TXT.