SPF, DKIM and DMARC for Cloudflare Email Routing

The DNS records Cloudflare Email Routing needs so your mail is authenticated and stays out of spam.

SPF	TXT at `@`	v=spf1 include:_spf.mx.cloudflare.net ~all Cloudflare creates `v=spf1 include:_spf.mx.cloudflare.net ~all` and locks it. If you also send as this domain (Gmail "Send mail as", a newsletter tool), that sender has to end up in the same single SPF record. Combine with your other senders →
DKIM	CNAME / TXT	Cloudflare adds a locked TXT record at `cf2024-1._domainkey` together with the MX records (`route1/2/3.mx.cloudflare.net`).
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

In the Cloudflare dashboard open Email → Email Routing → Routing rules and create a custom address (e.g. hello@) that forwards to your inbox.
Add the destination address. Cloudflare emails a verification link, except when it is your Cloudflare login address.
Go to Settings → DNS records and click Add missing records: three MX records, the SPF TXT and the DKIM TXT.
Keep or add DMARC. A domain that only receives can stay at p=reject.

Existing SPF record: if the domain already has one (say v=spf1 -all from when it was parked), the dashboard keeps showing SPF as Missing even after you edit it to the same value. Delete your own SPF record first, then click Add missing records so Cloudflare creates its managed one. Never leave two SPF records.
Email Routing only receives and forwards. Replying from the custom address needs a separate sending service, which then needs its own SPF include and DKIM.
Turning on the catch-all rule forwards everything sent to any address, spam included. Specific addresses are quieter.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.