How to Configure MX, SPF, and DKIM for a Cloudflare Easily 2026

Log into Cloudflare and land on the Domains page, listing every site connected to the account with its status, security insights, and plan. If you manage more than one domain, confirm you're about to edit DNS for the right one.

A status other than "Active" (for example, "Invalid nameservers") means DNS changes won't take effect until that's resolved first. Click the domain you need to configure mail for to open its overview.

The domain's Overview page shows traffic and request stats at a glance, but what you need is in the right-hand column: a DNS Setup indicator and a DNS Records link. That's the entry point for every record you're about to add. The left sidebar also has a dedicated DNS section further down, if you'd rather navigate there directly.

In DNS Records, click Add record and switch the type dropdown to MX. Leave the name as your root domain (or the @ symbol, depending on how Cloudflare labels it) unless your mail provider tells you to use a subdomain, then paste in the mail server host address they gave you, something like mail.yourprovider.com.

Set the priority number they specify. Lower numbers are tried first, which matters if your provider gives you more than one MX record for redundancy.

MX records in Cloudflare have no proxy option at all. The cloud icon next to them is fixed to grey, so there's nothing to configure there beyond the record itself.

SPF isn't its own record type in Cloudflare. It's a TXT record with a specific string format.

Add a new TXT record on your root domain with a value starting v=spf1, followed by the include or ip4 entries your mail provider requires, and ending in ~all or -all depending on how strict you want failed checks to be. If a TXT record already exists at that name for a different purpose, don't create a second SPF entry: most receiving mail servers only read the first SPF string they find at a name, so two conflicting records can break authentication instead of adding to it.

DKIM also goes in as a TXT record, but at a selector subdomain your provider assigns, something like selector1._domainkey.yourdomain.com. Copy the exact selector name and the public key string from your mail service's admin panel and paste the key as the record's value without adding line breaks. A single stray line break or space in that key is the most common reason DKIM validation fails after everything else looks right.

MX and TXT records, which is what SPF and DKIM both are, don't have a proxy toggle in Cloudflare at all. The cloud icon next to them is always grey, and there's nothing to switch.

The record type that can quietly break mail is anything your provider also asks for as an A or CNAME record, such as an autodiscover or webmail hostname: those do have a toggle, default to Proxied for new records, and need to be set to DNS Only manually when they're mail-related. Once everything is saved, give it time.

DNS changes can take anywhere from minutes to a few hours to propagate fully, so don't panic if a test email doesn't authenticate right away. Send yourself a message from an external address and check the headers, or use your mail provider's own SPF/DKIM verification tool, to confirm all three checks pass before you consider the migration done.