SPF, DKIM and DMARC · Checked 8 November 2026

Cloudflare Email Routing SPF, DKIM and DMARC records

The records that let mail sent through Cloudflare Email Routing pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

example.com.  IN  TXT  "v=spf1 include:_spf.mx.cloudflare.net ~all"
  • Email Routing uses this TXT record at the root of the domain. If the domain already has an SPF record, merge the include: into it. Never publish a second v=spf1 record.
  • Remember SPF allows only 10 DNS lookups, so check the merged record with the SPF checker.
  • Email Routing also publishes three MX records at the root: route1.mx.cloudflare.net, route2.mx.cloudflare.net and route3.mx.cloudflare.net, with priorities assigned automatically. They replace the MX records of any other mail provider on that domain.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • The DKIM record is a TXT record at cf2024-1._domainkey, starting v=DKIM1; h=sha256; k=rsa; p=.
  • The public key is long and specific to Cloudflare, so copy the full value from the dashboard rather than from an example.
cf2024-1._domainkey.example.com.  IN  TXT  "v=DKIM1; h=sha256; k=rsa; p=…key from the Cloudflare dashboard…"

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • Email Routing turned on for a domain that already has mailboxes elsewhere. Its MX records replace the existing ones and mail moves.
  • A second SPF record added instead of merging the include.
  • The long DKIM key truncated when pasted.
  • Expecting Email Routing to send mail. It forwards incoming mail; outgoing mail from the domain needs its own provider and records.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What is the SPF record for Cloudflare Email Routing?

v=spf1 include:_spf.mx.cloudflare.net ~all as a TXT record on the root domain. If you already have an SPF record, merge the include into it.

What MX records does Cloudflare Email Routing use?

route1.mx.cloudflare.net, route2.mx.cloudflare.net and route3.mx.cloudflare.net, with priorities assigned automatically.

What is the DKIM selector for Cloudflare Email Routing?

The record is a TXT at cf2024-1._domainkey. Copy the full key from the Cloudflare dashboard.

Does Email Routing replace my existing email?

It replaces the MX records, so inbound mail goes through Cloudflare. If you have mailboxes at another provider, do not enable it on that domain.