How to add a DMARC record in Cloudflare (step by step)

Your mailbox provider decides what goes in the record — Cloudflare is just where it lives. Here is the exact two-minute walkthrough, plus the two Cloudflare-specific mistakes that make a brand-new record invisible.

Check what your domain has today — free, no signup

Step 1: open the DNS records for your zone

1. Log in at dash.cloudflare.com and click the domain you're setting up.
2. In the left sidebar choose DNS > Records.
3. Click Add record.

Step 2: add the TXT record

Type:    TXT
Name:    _dmarc
Content: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
TTL:     Auto

• Name is just _dmarc — Cloudflare appends your domain for you. Typing _dmarc.yourdomain.com can create the doubled host _dmarc.yourdomain.com.yourdomain.com, which no mail server will ever look up.
• Paste the value without surrounding quotes. Cloudflare stores TXT content correctly on its own; pasted quotes end up inside the record.
• TXT records have no orange-cloud proxy option — nothing to toggle.
• Not sure what the tags mean, or want to add a policy percentage? Assemble the value with our free DMARC generator.

p=none changes nothing about delivery yet — it turns on the daily aggregate reports so you can see who is sending as your domain before you tighten anything. The levels are compared in p=none vs quarantine vs reject.

Step 3: verify it's live

Cloudflare DNS updates propagate in seconds to a few minutes. Confirm with:

dig +short TXT _dmarc.yourdomain.com

or run our plain-English DMARC checker — it tells you what the record actually does, not just that it exists.

Step 4: make sure SPF and DKIM are in place too

A DMARC record only evaluates mail — SPF and DKIM are what let legitimate mail pass. Both are also TXT records you add in the same Cloudflare screen, but their values come from your mailbox provider. Follow the guide for yours: Google Workspace, Microsoft 365, Zoho Mail, Amazon SES, or Mailgun. New to the three records? Start with SPF vs DKIM vs DMARC.

Common Cloudflare-specific mistakes

• The doubled name. _dmarc.yourdomain.com.yourdomain.com from typing the full hostname into the Name field. If a checker says "no record found" seconds after you saved one, look here first.
• Two DMARC records. If Cloudflare's own DMARC Management tool (Email section) already published a record, edit that one rather than adding a second — multiple v=DMARC1 records at _dmarc make receivers ignore them all. Cloudflare's tool is genuinely free for domains on its DNS; if you want plain-English weekly reports or you manage client domains that are not on Cloudflare, point rua at a monitoring service instead.
• Email Routing confusion. Cloudflare Email Routing (receiving) adds its own SPF include for forwarding — it does not authorize anything you send. Your outbound provider still needs its include in your SPF record, kept under 10 DNS lookups.

Using GoDaddy for DNS instead? The same walkthrough exists for adding a DMARC record in GoDaddy.