How to add a DMARC record on Cloudflare
DMARC tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM checks — and sends you reports about who is sending as your domain. Without it, authentication results are advisory and you fly blind.
The record is a TXT record at the _dmarc subdomain of your domain. Start with p=none (monitoring only — nothing about delivery changes), read the reports, then tighten to p=quarantine and finally p=reject.
The record you'll add
TypeTXT
Name_dmarcEnter just _dmarc — Cloudflare appends your domain automatically.
Valuev=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comPoint rua at a mailbox you actually read (an address on your own domain works without extra setup). If you send reports to a different domain, that domain's owner must publish an authorization record — most DMARC report services handle this for you.
TTLTTL Auto (300 seconds) is fine.
Steps on Cloudflare
- Log in at dash.cloudflare.com and select your domain.
- Go to DNS → Records.
- Click Add record and pick the record type.
- Enter the Name and Value shown above, then save.
Cloudflare quirks worth knowing
- ⚠Cloudflare adds the double quotes around TXT content itself — paste the value without quotes.
- ⚠TXT and CAA records have no proxy (orange-cloud) option; that's normal.
Provider steps verified against Cloudflare: Create DNS records on 2026-07-12.
Get the exact record for your domain
The free DMARC checker reads your domain's live DNS, flags what's wrong, and generates the precise DMARC record to publish — then rechecks to confirm the fix took.
Run the DMARC checker →Frequently asked questions
- What goes in the Name field on Cloudflare?
- Enter just _dmarc — Cloudflare appends your domain automatically, so don't type the full _dmarc.yourdomain.com.
- How long until the record is live?
- TTL Auto (300 seconds) is fine. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- Which DMARC policy should I start with?
- p=none. It changes nothing about mail delivery but turns on aggregate reporting, so you can see every source sending as your domain. Move to p=quarantine once the reports show all your legitimate senders passing, and to p=reject when quarantine has run clean for a few weeks.