How to add a DMARC record in Cloudflare

If your domain's DNS runs on Cloudflare, adding DMARC is one TXT record. Cloudflare also offers a free DMARC Management tool that creates the record for you and turns the raw reports into a readable dashboard.

This guide covers both. Start by checking what your domain already has.

Is your DNS managed at Cloudflare?

Your DNS is on Cloudflare if your domain's nameservers end in ns.cloudflare.com. Your domain registrar shows them, and so does the Overview page for your domain in Cloudflare.

If your nameservers point somewhere else, add the record there instead. Our DMARC fix guide has steps for other DNS hosts.

DMARC also depends on SPF and DKIM. Set those up for every service that sends email as your domain first, or your real email can fail DMARC once you tighten the policy. The free SPF checker shows your current SPF record.

What values do I enter in Cloudflare?

The value has three parts. v=DMARC1 marks the record as DMARC. p=none turns on monitoring without blocking anything. rua=mailto: sets where daily summary reports go.

Starting at p=none lets you see every service that sends email as your domain before you block anything. Google recommends a dedicated mailbox or group for reports, since they can arrive every day.

How do I add the record manually?

1. In the Cloudflare dashboard, select your account and domain.
2. Go to DNS → Records.
3. Look for an existing TXT record named _dmarc. If there is one, select Edit and update its content instead of adding another.
4. Otherwise, select Add record and choose TXT as the Type.
5. Enter _dmarc as the Name.
6. Paste v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com into Content, with your own address.
7. Leave TTL on Auto and select Save.

Cloudflare changes usually show up within minutes. Re-run the DMARC checker to confirm there's exactly one record.

Check SPF, DKIM and your website too

DMARC works best alongside SPF and DKIM. A free scan checks all three, plus your certificate and security headers, in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Should I use Cloudflare DMARC Management?

It's worth turning on if you'd like help reading reports. Cloudflare's tool lists every source that sends email as your domain and shows whether each one passes SPF, DKIM and DMARC. Raw DMARC reports are XML files, so a dashboard saves time.

To turn it on:

1. In the Cloudflare dashboard, select your account and domain.
2. Go to Email → DMARC Management.
3. Select Enable DMARC Management.
4. If you have no DMARC record, Cloudflare offers to add one that you can edit later. Select Add.
5. If you already have a record, Cloudflare adds a second rua address that sends reports to Cloudflare. Select Next.

DMARC Management only works on your main domain, such as yourbusiness.com, and needs Cloudflare DNS. You can still keep your own reporting address in the record alongside Cloudflare's.

What mistakes break a DMARC record in Cloudflare?

• Two DMARC records exist. Providers ignore DMARC when there's more than one, so edit the existing record instead of adding another.
• The Name is @ or blank, which puts the record on your main domain instead of _dmarc.
• The reporting address is missing mailto:. It must be written as rua=mailto:you@yourbusiness.com.
• The reporting inbox doesn't exist. Create the mailbox or alias first, or reports will bounce.
• The record was added in Cloudflare, but the domain's nameservers point somewhere else, so Cloudflare's records aren't used.

How do I tighten the policy later?

After two to four weeks of reports showing your real email passing, edit the same record:

1. Go to DNS → Records and select Edit next to the _dmarc TXT record.
2. Change p=none to p=quarantine, keeping the rest of the value the same.
3. Select Save.

Give quarantine a few weeks before you consider p=reject. Check with your team that invoices, contact form messages and newsletters still arrive. Our guide to reading DMARC reports shows what to look for before each step.

What should you do next?

• Re-run the DMARC checker to confirm one valid record.
• Review your reports, in your inbox or in DMARC Management, for two to four weeks.
• Move to p=quarantine using our DMARC policy guide.
• If your website is also on Cloudflare, add security headers in Cloudflare while you're in the dashboard.