Cloudflare DNS email authentication: keep web proxying separate

Define the decision

Cloudflare DNS hosting does not make Cloudflare your mailbox provider. The domain may use Cloudflare for its website while another service handles mail, signing and bounce routing. Keep those responsibilities explicit.

Work through the procedure

1. Collect exact SPF, DKIM, DMARC and MX instructions from the mail provider.
2. Check the active Cloudflare zone and existing records before editing.
3. Keep mail hostnames and authentication CNAMEs configured as required for DNS-only resolution.
4. Query the resulting records externally and validate fresh mail in both directions.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Website: www.example.com may use the HTTP proxy
Mail host: mail.example.com must resolve as required by the mail provider
DKIM CNAME: preserve the provider target
Final test: received signature passes and replies reach the mailbox

Read the result

The ordinary HTTP proxy is not a substitute for SMTP routing. A correctly configured website therefore says little about the health of email records.

Check before moving on

1. Preserve existing verification TXT records.
2. Check that an MX target resolves to the intended mail infrastructure.

Limits and next action

Do not change MX to fix an unrelated outbound SPF failure. Follow the responsible provider’s settings and keep a rollback record for DNS changes.

Source: Cloudflare: set up email records