Provider setup

Cloudflare DMARC: publish the record and understand the reports

Where the DMARC record lives on Cloudflare DNS, what DMARC Management adds to it, how to keep your reporting address, and why published is not passing.

By Updated Last verified

On this page
  1. Three jobs: DNS host, sender, report reader
  2. Add or check the record in the Cloudflare dashboard
  3. What enabling DMARC Management changes
  4. Keeping your current reporting address
  5. Published is not passing
  6. Troubleshooting
  7. Sources

On Cloudflare, your DMARC (Domain-based Message Authentication Reporting and Conformance) (opens in a new tab) record is a TXT record in your zone named _dmarc, which RFC 9989 (opens in a new tab) places at _dmarc.example.com for example.com. The values for your mail records depend on your email provider (opens in a new tab), and under RFC 9989's alignment rule (opens in a new tab) a message passes only when its Author Domain (opens in a new tab), the domain in its From header, matches, or shares an Organizational Domain with, a domain that SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) authenticated. Publish one record, decide where reports go, and use the reports to see which senders pass.

Three jobs: DNS host, sender, report reader

Keep three roles apart.

  • DNS host. The service where your DNS records are published. Cloudflare's email records guide (opens in a new tab) says to send and receive email from your domain you need an SMTP provider, and the exact values for your mail records depend on that provider. By default, Cloudflare does not proxy email traffic on port 25 (SMTP).
  • Sender. Each service that sends mail as your domain. The exact values for your DNS mail records depend on that provider.
  • Report reader. Whoever is at the reporting addresses in your DMARC record. RFC 9989 (opens in a new tab) allows a list of reporting URIs, and a report should be sent to each one.

RFC 9989 (opens in a new tab) stores the policy as a DNS TXT record whose name starts with the label _dmarc, so the owner of example.com publishes it at _dmarc.example.com. It recommends using both DKIM and SPF underneath DMARC.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

Add or check the record in the Cloudflare dashboard

To see your records on Cloudflare's security records page (opens in a new tab), go to Email > DMARC Management, then in Email record overview select View records. That page also lists records you already have, so look there before adding anything. It describes the DMARC record as telling receiving servers what to do when SPF or DKIM checks fail, for example reject or quarantine the email, and sending you aggregate reports about your email traffic.

You can also add the record by hand. Following Cloudflare's guide to managing DNS records (opens in a new tab), go to the DNS Records page, select Add record and choose the record type. A DMARC record is a TXT record named _dmarc, as RFC 9989 (opens in a new tab) defines it. The proxy status field is listed for A, AAAA and CNAME records. To change an existing record, select Edit on it instead of adding a second one.

A starting record built with the DMARC record generator monitors first and sends reports to one address:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The generator's rollout advice: start at p=none with a reporting address, which does not change delivery, and enforce once your reports show your real senders pass. If the record is at p=none, DMARC policy not enabled covers whether p=none affects delivery and the safe order to move to quarantine or reject.

What enabling DMARC Management changes

Cloudflare's enable page (opens in a new tab) explains that you enable DMARC Management so Cloudflare can process DMARC reports on your behalf. It works only on apex domains, such as example.com, not blog.example.com, and not on domains in subdomain setups. Cloudflare's DMARC Management overview (opens in a new tab) lists it as available on all plans for customers with Cloudflare DNS.

To turn it on, go to Email > DMARC Management and select Enable DMARC Management. Cloudflare then scans your zone:

  • No DMARC record found. Cloudflare invites you to add one that you can edit later.
  • A DMARC record found. Cloudflare adds another rua (Reporting URI for Aggregate data) entry to it, using a Cloudflare email address so that it can receive and process your reports.

The first report can take up to 24 hours to arrive and show in the dashboard. One warning from the same page: DMARC Management does not support changing SPF records when a CNAME record in your zone points to an external domain. Cloudflare recommends making those SPF updates through the external domain's DNS provider.

Keeping your current reporting address

You do not have to choose between Cloudflare and the address you already use. RFC 9989 (opens in a new tab) lets the record list several reporting URIs separated by commas, and a report should be sent to each one.

Checked against live DNS, _dmarc.cloudflare.com publishes:

v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com

That is two rua addresses in one record: one at dmarc-reports.cloudflare.net and one at cloudflare.com.

A reporting address on another domain needs that domain's permission. RFC 9990 (opens in a new tab) allows report destinations outside the domain owner's authority, but the receiving domain must publish a confirming record in its DNS; without it, the receiver ignores that address. For the record above, cloudflare.com._report._dmarc.dmarc-reports.cloudflare.net answers v=DMARC1; in live DNS. Any reporting address you keep on another domain needs the same kind of confirming record for your domain, published by that address's domain.

Published is not passing

A valid record states your policy; it does not show how your mail fares. RFC 9989 (opens in a new tab) requires the Author Domain (opens in a new tab), the domain in the From header, to match, or share an Organizational Domain with, a domain that SPF or DKIM authenticated. A message can bear a valid signature from any domain, even one used by a bad actor, and any DKIM signature whose domain aligns with the From domain produces a DMARC pass.

Two different tools answer two different questions:

  • The free SPF, DKIM and DMARC check reads the records your domain publishes. For DMARC it flags a missing record, a policy of none, no reporting address, a policy that covers only part of your email, and subdomains left at none. A DNS finding shows how your domain is set up; it does not show where a particular message landed.
  • The aggregate reports show the messages. Cloudflare's statistics page (opens in a new tab) graphs email volume for a period of up to 30 days, lists reports by date, and shows the top 10 sources sending on your behalf with how they fared regarding security policies. If your reports go to a mailbox instead, the free DMARC report analyzer reads one report as a table of sources, message counts, SPF and DKIM alignment and what the receiver did, in your browser.

When a source fails, DMARC fail covers how to read dmarc=fail in the Authentication-Results header and how to fix SPF and DKIM alignment, and DMARC reports explains the main elements of an aggregate report. An unknown source is not automatically abuse: forwarding, mailing lists and forgotten tools also appear as unexpected sources.

Troubleshooting

Sources

Tools for this

Frequently asked questions

Where do the values for my email records on Cloudflare come from?

From your email provider. The exact values for your DNS mail records depend on your email provider.

Can I keep my current DMARC reporting address?

Yes. When a DMARC record already exists, enabling DMARC Management adds another rua entry with a Cloudflare address to it, and a DMARC record may list several reporting addresses separated by commas.

Why is a published DMARC record different from passing messages?

The record tells receiving servers what to do when SPF or DKIM checks fail and sends you aggregate reports. A message passes DMARC when the domain in its From header aligns with a domain that SPF or DKIM authenticated, and the aggregate reports show whether messages sent from your domain pass SPF, DKIM and DMARC.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account