Defaults.Exposed

Defaults.Exposed › Setup walkthroughs › DMARC › Cloudflare

Set up DMARC on Cloudflare

One TXT (Text) record at _dmarc, and one thing this console does not ask you for: there is no proxy toggle on it. TXT records are never proxied, so the orange and grey cloud you set on other record types does not appear here and does not need thinking about.

The DMARC record for Cloudflare

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

v=DMARC1 is the version and comes first. p=none is the policy. rua=mailto: names the mailbox the aggregate reports are delivered to.

At p=none nothing is blocked and no mail is treated differently; the record only starts the reporting that lets you move to quarantine and then to reject. A record at p=none is often mistaken for a finished job.

In the October 2026 census, counting every domain that exists, 35,049,364 of the 43,720,472 domains at p=none, 80.17% of them, publish no rua= address either, so they are not even collecting the reports that would let them move on. Meanwhile 249,025,625 of the 332,492,319 domains graded or found dead, 74.9%, publish no DMARC (Domain-based Message Authentication, Reporting and Conformance) record at all.

Check that Cloudflare answers DNS for the domain

Open the domain in Cloudflare and check the Overview page to confirm Cloudflare is active. The record only works if the domain’s nameservers point at the Cloudflare nameservers shown in the dashboard. If they point elsewhere, add the record at whichever provider runs DNS (Domain Name System) instead.

Cloudflare is the DNS host here, not the mailbox provider. It stores and answers the DNS records for the domain, including the DMARC TXT record exactly as typed; it does not read mail or generate the policy value. The reports come from the receiving mail providers, which send them to the rua= mailbox.

Add the record in the Cloudflare console

  1. Sign in to Cloudflare and select the domain from the account dashboard.
  2. In the left-hand menu, go to DNS and open the Records section.
  3. Click Add record to start a new DNS entry.
  4. Set the type to TXT.
  5. In the Name field, enter exactly _dmarc and nothing else.
  6. In the Content field, enter v=DMARC1; p=none; rua=mailto:you@yourdomain.com and replace the address with a mailbox that is read.
  7. Leave the TTL (Time to Live) field on Auto.
  8. Click Save.

In the Name field enter exactly _dmarc, with the leading _ character, and do not append the domain, since Cloudflare appends it automatically; typing _dmarc.yourdomain.com there is wrong. In the Content field paste the plain value starting v=DMARC1; with the reporting address swapped for a mailbox that is read.

Traps in the Cloudflare form

Where the reports come from, and what they contain

The reports come from the receiving mail providers, Google, Microsoft, Yahoo and the rest, each sending an aggregate report to your rua= address covering the mail they saw claiming to be from your domain.

Each report is an XML file, usually covering one day, listing source IP (Internet Protocol) addresses with a count of messages and the SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) results for each. Read a week of them and you have an inventory of everything sending as you, which almost nobody has before they start.

The volume from a small domain is manageable but tedious in raw XML, so most people either use a parser or point rua= at a hosted DMARC reporting service. And if you point rua= at an address on a domain you do not control, that domain has to publish a record authorising it, in the form of a TXT record at yourdomain.com._report._dmarc.theirdomain.com. A reporting service will tell you to publish exactly that; an address on your own domain needs nothing extra.

The three policy values, and getting between them

p= takes one of three values and each is a different request. none asks receivers to change nothing and report back. quarantine asks them to treat failing mail as suspicious, which in practice means the spam folder. reject asks them to refuse it at the door, so it never reaches a folder at all.

Moving between them does not have to be a leap. pct= applies the policy to a share of failing messages rather than all of them, so v=DMARC1; p=quarantine; pct=10; rua=mailto:you@yourdomain.com quarantines one failure in ten. If something was missed, only a tenth of its failing mail is quarantined, and the reports still show the problem. Raise the number as the reports stay clean, then drop the tag and go to reject.

Two tags are worth knowing about and leaving alone for now. sp= sets a separate policy for subdomains, which becomes useful when a marketing platform sends from one and is not ready for the parent’s policy. adkim= and aspf= decide whether alignment is relaxed, the default, or strict, and relaxed is the right answer almost always because it lets a subdomain satisfy the parent domain.

Wait, then read the result

A DNS change on Cloudflare can take a few minutes up to a couple of hours to take effect. The saved record appears in the DNS Records list for the domain, listed as a TXT record with the name _dmarc. Reopen the DNS Records list in Cloudflare and confirm the TXT record named _dmarc shows the saved content exactly as entered.

How the scan grades this record: the DMARC policy check, with its pass and fail rules and how many domains pass it.

When the reports show every legitimate sender passing and aligning, raise the policy to p=quarantine, then to p=reject. Receivers act on the record only at p=quarantine or p=reject. The DMARC guide covers the rest of the tags.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.