Email Security (SPF / DKIM / DMARC)

Cloudflare DMARC, SPF & DKIM — stop your domain being spoofed

We configure SPF, DKIM and DMARC in Cloudflare DNS and walk your policy from monitoring to enforcement — helping reduce spoofing and impersonation of your domain and improve how your legitimate email is delivered.

Fix our email auth Request a Cloudflare Audit

Who this is for

Brands worried about email impersonation
Teams whose mail lands in spam
Domains stuck on DMARC p=none
Cloudflare Email Routing users since 2025

The three records explained

What SPF, DKIM and DMARC actually do

Three DNS records that, together, let receiving mail servers tell genuine email from your domain apart from forgeries.

SPF — who may send

Sender Policy Framework is a DNS record listing the servers and services allowed to send mail for your domain. Receivers check the sending server against it; unlisted senders fail SPF.

DKIM — was it tampered with

DomainKeys Identified Mail adds a cryptographic signature to each message using a private key, with the public key in DNS. Receivers verify the signature to confirm the mail was not altered.

DMARC — what to do on failure

DMARC builds on SPF and DKIM with alignment checks, tells receivers how to treat failures (none, quarantine or reject) and requests aggregate reports so you can see what is sent as your domain.

Problems we solve

The email-authentication issues we see most

Attackers spoof your domain

Without enforced DMARC, anyone can send mail that appears to come from your domain, fuelling phishing and brand impersonation against your customers and staff.

Legitimate mail lands in spam

Missing or broken SPF and DKIM mean mailbox providers distrust your mail, so invoices, receipts and campaigns get filtered or rejected.

SPF record is over the limit

Too many includes push SPF past its 10-lookup cap and it silently fails. We consolidate senders into a single valid record.

DMARC stuck on p=none

A monitoring-only policy was published months ago and never advanced, so it reports problems but does nothing to reduce spoofing.

Reports nobody reads

DMARC aggregate reports arrive as raw XML to an inbox no one checks, so you have no visibility into who is sending as you.

Email Routing stopped working

Cloudflare made SPF and DKIM required for Email Routing in 2025; misaligned records can break forwarding until authentication is fixed.

What we configure

SPF, DKIM and DMARC, set up properly in Cloudflare

Every record validated in Cloudflare DNS, with report monitoring so you can move toward enforcement with confidence.

SPF records

A clean, consolidated SPF record in Cloudflare DNS that lists every legitimate sender — your mailbox provider, marketing tools and apps — while staying inside the 10-lookup limit.

DKIM signing

DKIM keys published for each sending service so receivers can verify your mail was not altered in transit. We keep selectors organised and rotate keys when a provider supports it.

DMARC policy

A DMARC record that ties SPF and DKIM together with alignment, tells receivers how to handle failures, and points aggregate reports where you can actually read them.

Cloudflare DNS setup

All records configured and validated directly in Cloudflare DNS, with the proxy and DNS-only settings set correctly so mail flow and authentication are not disrupted.

DMARC report monitoring

Cloudflare DMARC Management ingests aggregate (RUA) reports so you can see who sends as your domain, spot misconfigured tools and watch alignment before you tighten policy.

Staged enforcement

A measured journey from p=none to quarantine to reject, only moving forward once reports show your legitimate mail passes — so enforcement reduces spoofing without dropping real email.

DMARC reporting

How do you reach DMARC enforcement without losing real email?

The risk with DMARC is moving to reject before your own tools are aligned — newsletters, CRMs and helpdesks can quietly fail and legitimate mail gets dropped. The fix is data, not guesswork.

We start at p=none and route aggregate reports into Cloudflare DMARC Management, which parses the raw XML into a readable view of who sends as your domain. Only once the reports show your real mail passing SPF and DKIM do we tighten the policy, step by step.

Talk to a specialist

How we de-risk enforcement

Aggregate (RUA) reports parsed, not left as raw XML
Every legitimate sender identified and aligned first
Policy advanced only when reports stay healthy
Ongoing monitoring so new senders don't break mail

DMARC enforcement journey

From monitoring to enforcement, in safe stages

We never jump straight to reject. Each stage is driven by what the reports show, so enforcement reduces spoofing without cutting off your own email.

1
p=none — monitor
We publish DMARC in monitoring mode and route aggregate reports into Cloudflare DMARC Management. Nothing is blocked yet; we watch which senders pass and which fail alignment.
2
Fix alignment
Using the reports, we correct SPF and DKIM for every legitimate tool — newsletters, CRMs, helpdesks — until your real mail consistently passes both checks with proper alignment.
3
p=quarantine
Once legitimate mail is clean, we move to quarantine, optionally with a percentage rollout, so unauthenticated mail claiming your domain is sent to spam rather than the inbox.
4
p=reject — enforce
When reports stay healthy at quarantine, we move to reject so receivers refuse spoofed mail outright. We keep monitoring reports so new senders are added before they break.

Scope

What is and isn’t included

Honest boundaries from the start: this is DNS-based authentication for your domain, not a full email-security suite.

What is included

SPF record built and consolidated within the 10-lookup limit
DKIM keys and selectors published for each sending service
DMARC record with alignment and reporting configured
Cloudflare DMARC Management report monitoring set up
Staged journey from p=none to quarantine to reject
Validation of Cloudflare Email Routing authentication

What is not included

Inbound malware, attachment and link scanning
A secure email gateway or anti-spam filtering product
Mailbox hosting, migration or mail server administration
Sending reputation, list hygiene or campaign content
User phishing-awareness training and incident response

When you need this

Customers report emails pretending to be from you
Your legitimate mail keeps landing in spam
Your SPF record fails or exceeds the lookup limit
DMARC has sat on p=none for months with no progress
Cloudflare Email Routing broke after the 2025 changes
You want clear visibility of who sends as your domain

When Cloudflare is not enough

SPF, DKIM and DMARC harden your domain’s outbound identity, but email security is broader. This work does not replace:

Secure development, code review and timely patching of your application and plugins.
Backups, disaster recovery and a tested restore process.
A dedicated anti-fraud, chargeback or payment-risk platform.
Hosting, database administration and origin server maintenance.
Full incident response and forensics for large or regulated enterprises.

What email authentication can and cannot do

Enforced SPF, DKIM and DMARC help reduce spoofing and impersonation of your own domain and can improve how your legitimate mail is delivered. No DNS configuration can stop all phishing — look-alike domains, compromised third parties and inbound malware are outside its scope — and it does not replace a secure email gateway, inbound filtering, user training or wider security controls. We configure it as one strong layer in your overall email security.

Related services

Explore related Cloudflare services

Cloudflare ConsultantAudit, implementation and optimisation.Cloudflare AuditIndependent review of your full config.Zero Trust ConsultantIdentity-based access without a VPN.Managed Cloudflare ServicesOngoing monitoring and rule tuning.ContactTell us what’s breaking with your mail.

Frequently asked questions

What are SPF, DKIM and DMARC in plain terms?

They are three DNS-based email authentication standards. SPF (Sender Policy Framework) lists which servers are allowed to send mail for your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature so receivers can confirm a message was not altered. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together, tells receiving servers what to do when a message fails, and sends you reports. Together they help receivers decide whether mail claiming to be from your domain is genuine.

Will this stop all phishing against our company?

No, and we are careful not to claim that. Enforced DMARC helps reduce spoofing and impersonation of your own domain, which cuts one common phishing vector and protects your brand. It does nothing about phishing sent from look-alike domains, compromised third parties or inbound malware reaching your staff. For those you still need a secure email gateway, inbound malware filtering, user training and the usual security basics. We configure authentication as one layer, not a complete anti-phishing solution.

Does Cloudflare DMARC improve email deliverability?

It can help. Correct SPF and DKIM with aligned DMARC are signals mailbox providers use to trust your mail, so getting them right often improves how your legitimate email is treated. Deliverability also depends on factors outside DNS — sending reputation, list hygiene, content and complaint rates — so we set realistic expectations and focus on the authentication layer we can control in Cloudflare.

How does Cloudflare DMARC Management help?

DMARC aggregate (RUA) reports are XML files that are hard to read by hand. Cloudflare DMARC Management collects and parses those reports so you can see which sources send mail as your domain, whether they pass SPF and DKIM, and where alignment is failing. That visibility is what lets us safely advance your policy from p=none toward quarantine and reject without cutting off legitimate senders.

Why did our Cloudflare Email Routing break in 2025?

In 2025 Cloudflare made SPF and DKIM authentication a requirement for Email Routing. If your sending or forwarding setup relied on records that were missing, misaligned or failing, routing can stop working until authentication is corrected. We review your DNS, fix the SPF and DKIM records and validate that routing and authentication work together again.

Is this a replacement for a secure email gateway?

No. This service is DNS-based outbound authentication and anti-spoofing for your own domain — SPF, DKIM, DMARC and report monitoring. It is not an email gateway and does not scan inbound messages for malware, attachments or links. If you need inbound filtering, sandboxing or data-loss prevention, that is a separate product we are happy to advise on alongside the DNS work.

How this project is scoped — no hourly meter

Fixed scope, fixed timeline — priced by deliverable against an agreed Statement of Work, not by an hourly meter. Typically 2–4 weeks, delivered remotely.

What's included

Discovery & kick-off call to confirm goals and scope
Architecture & configuration review
Cloudflare setup for the agreed scope: DNS, SSL/TLS, WAF baseline, caching/performance and the products in your plan
Validation and a supervised go-live
Handover pack: runbook, configuration documentation and a team walkthrough
A 14-day post-go-live support window for fixes to what we configured

Not included (quoted separately)

Non-Cloudflare work (application/backend changes, third-party security tools)
Additional domains/zones beyond the agreed scope
Ongoing monthly management (that is a Care plan)
Anything not in the Statement of Work — handled as a separately quoted change order

Indicative “from” prices are a starting point. Your final price is confirmed in a written proposal after a free scoping call, and depends on the number of zones, the Cloudflare products in scope and environment complexity.

Fix your email authentication at the DNS layer

Start with a review of your SPF, DKIM and DMARC, or tell us what’s breaking. You’ll get clear, vendor-neutral steps to reduce spoofing of your domain and reach DMARC enforcement safely.