DNS help › Cloudflare

How to add SPF, DKIM and DMARC records in Cloudflare

Many businesses move their DNS to Cloudflare for speed and protection, even when the domain was bought elsewhere. If your nameservers point to Cloudflare, Cloudflare is where your records live, not your original registrar.

This guide shows where to find your DNS settings, how to add or change a record, and what the main email records do.

Before you start

If a hosting company added your domain to Cloudflare for you, Cloudflare says to manage the records through that hosting company instead.

Step 1: Log in and find your DNS settings

1. Log in to the Cloudflare dashboard and choose your domain.
2. Go to DNS, then Records.

Step 2: Add a TXT record

1. Select Add record.
2. Choose TXT as the record type.
3. In Name, enter the host (use @ for the domain itself).
4. In Content, paste the record text.
5. Leave TTL on Auto.
6. Select Save.

About the Name field: Cloudflare adds your domain name for you, so enter only the prefix, for example _dmarc.

Changing an existing record

To change a record, go to DNS > Records, select Edit on the record, make your change and select Save.

Adding a CNAME record

For a CNAME record (Microsoft 365 uses these for DKIM), choose CNAME as the type. Important: set the proxy status to DNS only (grey cloud), not proxied (orange cloud). Microsoft notes that DKIM fails if the record is proxied.

The same steps work for the Tidy Cyber ownership record: Name _tidycyber-verify, with the code we show you when you verify. The code is unique to you and your domain.

Step 3: Understand your email records

These are the records our check looks at. If one already exists, it usually needs editing rather than adding another.

SPF: say who can send email for you

SPF is a single TXT record on your domain that lists the services allowed to send email as you, such as your email provider, newsletter tool or invoicing system. Without it, it's much easier for a scammer to send email that looks like it came from you.

A domain can only have one SPF record, so if you already have one, it needs editing rather than adding a second. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DMARC: tell the world what to do with fakes

DMARC is a TXT record that tells other mail servers what to do with email that fails the SPF and DKIM checks, and can send you reports about who is sending email using your name.

It's best introduced gently: first just watching, then gradually asking receivers to junk and then refuse fake email, once you're sure your genuine email passes. Our free check flags a watch-only policy as a high risk, because fakes are still delivered. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DKIM: sign your emails

DKIM adds a digital signature to the email you send, so receivers can tell it really came from you and wasn't changed on the way. Your email provider creates the key and you publish it in your DNS, as a TXT record or as CNAME records depending on the provider. You can't make up a DKIM value yourself.

In Google Workspace, DKIM lives in the Google Admin console under Gmail's Authenticate email settings. In Microsoft 365, it's on the DKIM tab of the Email authentication settings in the Microsoft Defender portal (see our Microsoft 365 guide). Newsletter tools and booking systems usually have their own DKIM settings. For a CNAME record (Microsoft 365 uses these for DKIM), choose CNAME as the type. Important: set the proxy status to DNS only (grey cloud), not proxied (orange cloud). Microsoft notes that DKIM fails if the record is proxied.

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Domains that don't send email

Spare and old domains you never email from can still be used to fake email in your name, so they need locking down too, in a slightly different way from a domain you do use. The full report checks for this and gives the exact records for that domain.

Optional: DNSSEC

DNSSEC adds tamper protection to your DNS records. Our check reports it as a low-priority item. Cloudflare offers DNSSEC in the DNS settings for your domain. It also involves a record at the company where you registered the domain. Whether it applies to your domain depends on your provider and domain ending; the full report tells you.

Check it worked

DNS changes can take a little while to show everywhere, so allow some time before checking. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.

Official Cloudflare help

We checked these steps against the official guides in October 2026. Screens do change, so if something looks different, follow the provider's own guide:

• Manage DNS records
• DNSSEC

← All DNS guides