How to Add a DMARC Record in Cloudflare

The short answer. Add one TXT record in Cloudflare with the host _dmarc and the value v=DMARC1; p=none; rua=mailto:[email protected];. Start with p=none, read the reports, then tighten the policy.

---

What a DMARC Record Does#

DMARC tells receiving mail servers what to do with messages that claim to be from your domain but fail SPF and DKIM, and where to send reports about them. Without it anyone can send convincing mail as your domain, including domains you never send from. The record is a single TXT record at _dmarc.

Check Where Your DNS Is Managed#

A record only works at the company that answers DNS for the domain, which is not always the one you bought it from. Cloudflare serves DNS only when the domain’s nameservers are two Cloudflare ones (they end in ns.cloudflare.com). The domain’s Overview page shows Active when that is the case.

The DMARC Record to Add#

v=DMARC1; p=none; rua=mailto:[email protected];

Replace [email protected] with a mailbox you read. p=none only collects reports and blocks nothing, so it cannot break your mail. The policies, mildest first:

Step by Step in Cloudflare#

Step 1. Open the domain

Sign in to the Cloudflare dashboard and click the domain on the Websites page.

Step 2. Open DNS Records

In the left menu choose DNS, then Records.

Step 3. Add a record

Click Add record. The form opens above the list.

Step 4. Enter the DMARC record

Choose TXT as the type and fill in the fields:

• Name: _dmarc
• Content: v=DMARC1; p=none; rua=mailto:[email protected];
• TTL: Leave TTL on Auto.

The value to copy:

v=DMARC1; p=none; rua=mailto:[email protected];

Step 5. Save

Click Save. Cloudflare shows the record in the list at once.

Change an Existing DMARC Policy#

A domain can have only one DMARC record, so change the existing one rather than adding a second. Open the DMARC TXT record at _dmarc in Cloudflare, and edit only the part you need. Click Edit at the end of the row to change it, and Delete inside that panel to remove it. Click Save.

To move from monitoring to enforcement, change p=none to p=quarantine, watch the reports for a few weeks, then move to p=reject:

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected];

pct=100 applies the policy to all failing mail. A lower number applies it to that share only, which is useful while you are still checking senders.

Common Mistakes#

• Adding a second DMARC record. If two exist, receivers ignore both, and the domain has no DMARC at all. Edit the existing one.
• Jumping straight to p=reject before every legitimate sender passes SPF or DKIM. Real mail from forgotten services, such as a newsletter tool, gets refused.
• Putting the full _dmarc.example.com in the host field, which ends up as _dmarc.example.com.example.com.
• A report address on another domain. That domain must publish a record allowing your reports, or they are silently dropped. Use an address on your own domain.
• Expecting DMARC to help without SPF or DKIM. It only checks the results of those two.
• Wrapping the value in quotes. Cloudflare adds them itself; typed quotes become part of the value.

Check That It Worked#

Look the record up after saving: a TXT query for _dmarc.example.com should return the value you entered. Changes show up as caches expire, usually within minutes for a record and up to two days for nameservers, see how long DNS propagation takes.

More Cloudflare DNS Guides#

• How to Add an SPF Record in Cloudflare
• How to Add a TXT Record in Cloudflare
• How to Change Nameservers in Cloudflare
• How to Add MX Records in Cloudflare

The same task elsewhere: Namecheap, GoDaddy, Hostinger, Squarespace.

Menu names last checked October 2026. Providers rename things now and then; if a label differs, look for the closest match.