Guide per DNS host

Add a DMARC record at Cloudflare

The DMARC record is a TXT record under the name _dmarc and takes minutes to set at Cloudflare. The name is what matters: it must resolve to _dmarc.your-domain.com, not just the domain. This guide shows the starting value, the way through the Cloudflare control panel and how to reach p=reject afterwards.

The starting value

With p=none nothing changes for delivery, you only receive reports. That is the right start because the reports show which services send on behalf of the domain and whether SPF and DKIM match for them. The rua address should be a mailbox someone reads, or a report service.

v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com

Afterwards: quarantine and reject

After four to eight weeks of reports and fixed SPF and DKIM records, edit the record at Cloudflare to p=quarantine, with pct=25 if you like, and finally p=reject. The record is only edited, never recreated.

v=DMARC1; p=reject; rua=mailto:dmarc@your-domain.com; adkim=s; aspf=s

How to add the DMARC record at Cloudflare

The way to the Cloudflare DNS editor:

  • In the Cloudflare dashboard open the domain and choose "DNS" → "Records".
  • Choose "Add record" and enter type, name and content.
  • For MX, TXT and mail-related CNAME records keep the proxy status on "DNS only"; the orange cloud belongs to web records only.
  • Type TXT, host name _dmarc (at some hosts _dmarc.your-domain.com), value: the DMARC record starting with v=DMARC1.
  • Save; Cloudflare propagates instantly.

Typical mistakes at Cloudflare

  • Wrong name: the record sits on the domain instead of _dmarc.
  • Domain doubled in the name (_dmarc.your-domain.com.your-domain.com) because the host appends the domain itself.
  • rua without mailto: or with a typo, then no reports arrive.
  • p=none stays forever and protects nothing.

Verify and keep an eye on it

After saving, the change at Cloudflare usually applies within minutes. The checker below queries the authoritative name servers and shows right away whether the DMARC record is read correctly. DomainWarn keeps checking the record afterwards and alerts you when it changes or disappears, for example after a migration or one click too many in the DNS editor.

Frequently asked questions

Do I enter _dmarc or _dmarc.your-domain.com at Cloudflare?
It depends on the editor: if Cloudflare appends the domain automatically, enter just _dmarc. The result must be _dmarc.your-domain.com; the DMARC checker shows whether it is right.
Can I set DMARC without DKIM?
Yes, with p=none for monitoring. For quarantine or reject DKIM should be in place because SPF breaks on forwarding.
Check now

Free DMARC record check: policy (none, quarantine, reject), pct, reporting addresses and syntax errors. With recommendations for moving to p=reject.

DomainWarn checks SPF, DKIM, DMARC, DNS and certificates of all client domains regularly and reports changes before mail lands in spam.

Monitor this domain continuously14-day free trial, no credit card.

The same guide for other hosts