DMARC record for Cloudflare

Does this page apply to you?

Run this first. Cloudflare only matters if it is where your DNS or mail actually lives.

dig +short NS yourdomain.com

Expect: Two names ending in .ns.cloudflare.com. If you see anything else, DNS is hosted elsewhere and edits here will have no effect.

Specific to Cloudflare

• The record name is _dmarc; Cloudflare appends the zone.
• Cloudflare also offers a DMARC Management feature that receives and summarizes reports for you. Using it is optional; you can publish the TXT and send rua to your own mailbox instead.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  _dmarc  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What the receiving server does with this record

When a message arrives, the receiver looks up _dmarc. plus the From domain. DMARC passes when SPF or DKIM passes and the domain that passed matches the From domain. If it fails, the p= policy decides what happens: none does nothing, quarantine sends it to spam, reject refuses it. Either way the receiver can email you an aggregate report.

Mistakes that break it

• Jumping to `reject`. Start at p=none, read the reports, fix every legitimate sender, then tighten. Enforcing before that loses real mail.
• Two DMARC records. Like SPF, a domain should have only one.
• Reports into your inbox. Aggregate reports arrive daily as zipped XML from every provider that saw your mail. Use a dedicated address or a report parser.
• A `rua` address on another domain. Reports to an external domain are only sent if that domain publishes a record authorizing it.

Gmail and Yahoo have required DMARC from bulk senders since 2024, at a minimum p=none. Build the record with the DMARC generator.

Check it from the command line

dig +short TXT _dmarc.yourdomain.com