How to Configure Cloudflare DNS for Email (SPF, DKIM, DMARC)

What you're doing and why it's painful

SPF, DKIM, and DMARC are DNS records that prove your emails are legitimate. Without them, emails from your domain — including transactional emails like password resets and receipts — land in spam or get rejected entirely.

The pain: each record has its own syntax, the values come from your email provider (not Cloudflare), and getting any single character wrong silently breaks delivery. DMARC in particular requires SPF and DKIM to already be working before it has any effect — there's an order dependency that's not obvious.

This guide covers the setup specifically for Resend, but the DNS record types and structure are the same for any email sending service (SendGrid, Postmark, AWS SES, etc.) — just substitute your provider's values.

Prerequisites

• Your domain is on Cloudflare
• You have a Resend account and want to send from @yourdomain.com
• Your domain's MX records are set up if you're also receiving email (not covered here)

Step 1 — Get the DNS records from Resend

1. Log in to Resend
2. Go to Domains → Add Domain
3. Enter your domain — e.g. yourdomain.com
4. Resend will show you a list of DNS records to add. They'll look something like:

Keep this window open — you'll copy these values into Cloudflare.

Step 2 — Add the SPF record

SPF tells receiving mail servers which services are authorised to send email on behalf of your domain.

1. In Cloudflare, go to DNS → Records → Add record
2. Type: TXT
3. Name: @ (the root domain)
4. Content: the SPF value from Resend — e.g. v=spf1 include:_spf.resend.com ~all
5. Proxy: DNS-only (grey cloud — TXT records must never be proxied)
6. Save

Important: You can only have one SPF record (v=spf1) per domain. If you already have an SPF record for another mail service, merge them into one:

v=spf1 include:_spf.resend.com include:_spf.other-provider.com ~all

Adding a second SPF record breaks SPF for your whole domain.

Step 3 — Add the DKIM record

DKIM adds a cryptographic signature to outgoing emails. Receiving servers check the signature against the public key in this DNS record.

1. Add record → Type: TXT
2. Name: resend._domainkey (or whatever Resend specifies — the prefix changes per provider)
3. Content: the long p=... key from Resend
4. Proxy: DNS-only
5. Save

The key value is long — make sure you copy the entire thing including the p= prefix.

Step 4 — Add the DMARC record

DMARC tells receiving servers what to do when SPF or DKIM fails: ignore it (none), quarantine it (send to spam), or reject it.

1. Add record → Type: TXT
2. Name: _dmarc
3. Content: v=DMARC1; p=none; rua=mailto:[email protected]
4. Proxy: DNS-only
5. Save

Start with p=none (monitor only) until you've confirmed your emails are passing SPF and DKIM. Jumping straight to p=reject before your setup is verified will cause your own legitimate emails to be rejected.

Step 5 — Verify in Resend

Go back to Resend's domain verification page and click Verify DNS records. All three records should show as verified within a few minutes (sometimes up to 24 hours for DNS propagation).

Testing your email authentication

Once verified, send a test email to a Gmail account. In Gmail, click the three-dot menu on the email → Show original. You should see:

SPF:        PASS
DKIM:       PASS
DMARC:      PASS

Common errors and gotchas

SPF record not verifying Check for extra spaces or line breaks in the TXT value. Cloudflare's UI sometimes wraps long values — make sure the full value is on one line. Also check you don't have duplicate SPF records.

DKIM key not verifying The key value must be exact. If it's very long, check that your DNS editor didn't truncate or add line breaks. Some DNS editors have a 255-character limit per string — Cloudflare handles splitting automatically but other providers may not.

DMARC shows failures even with SPF/DKIM passing The from domain in your email headers must match the domain SPF and DKIM are configured for. If you're sending from [email protected] but SPF is set up for mail.yourdomain.com, alignment will fail.

Emails still going to spam after adding all records DNS propagation can take up to 48 hours. Also check your email content — spam filters look at content, not just authentication. Newly verified domains also have no sending reputation, so start with low volume.

p=reject blocking legitimate emails If you set DMARC to p=reject before confirming SPF and DKIM are working, your own emails may be rejected. Change back to p=none, diagnose using DMARC reports (rua address), then gradually move to p=quarantine then p=reject.