Why must many mail DNS records stay DNS-only in Cloudflare?

Orange-cloud proxying can interfere with MX, DKIM CNAMEs, or provider expectations unless the vendor explicitly documents proxied support.

How strict should TXT quoting be for SPF or DKIM?

Follow your mail provider’s exact TXT formatting—split strings and quotes matter because oversized or malformed TXT payloads fail verification.

Troubleshooting

Publishing DNS records in Cloudflare

TXT and CNAME entries for SPF, DKIM, and DMARC when Cloudflare proxies email-related names correctly.

Published: 2026-05-01Last reviewed: 2026-05-01

Proxy status

Mail-related hostnames used for MX or DKIM CNAMEs generally must be DNS only (grey cloud) unless your provider explicitly supports proxied modes—incorrect orange-cloud settings break mail.

TXT entries

Add SPF, DKIM public keys, and DMARC TXT records exactly as supplied—preserve quotation rules your provider documents.

References

See Cloudflare DNS record basics for UI navigation patterns.

FAQ

Why must many mail DNS records stay DNS-only in Cloudflare?: Orange-cloud proxying can interfere with MX, DKIM CNAMEs, or provider expectations unless the vendor explicitly documents proxied support.
How strict should TXT quoting be for SPF or DKIM?: Follow your mail provider’s exact TXT formatting—split strings and quotes matter because oversized or malformed TXT payloads fail verification.

More in this category

Allowlisting FormReceipt automation

How to allowlist FormReceipt bot identity headers, user agent, and worker IPs in WAF or anti-bot tools.

DNS propagation and TTL

Why DNS changes lag, how TTL affects rollout, and how to verify TXT records globally.

Mail arrives in spam despite passing authentication

Why authenticated mail can still land in spam and what to check next.

Multiple SPF TXT records

Why multiple SPF TXT strings break validation and how to merge includes into a single record.

← Troubleshooting Knowledge base home ← Back to home