Add a DMARC record in Cloudflare

Updated 2026-07-08 · Setup Guides

Cloudflare is one of the easiest places to publish a DMARC record: changes go live in seconds and the record editor does the right thing with underscored names. Here's the exact record, the exact steps, and the handful of mistakes that account for nearly every "I published it but it doesn't work".

These steps apply when the domain uses Cloudflare's nameservers — which it does if the zone shows as Active in your Cloudflare account. A domain merely registered elsewhere and never moved onto Cloudflare DNS needs its record published wherever its nameservers actually point.

The record you're publishing

The Content value is your DMARC policy. If you're setting up monitoring with DMARCmetric, Add your first domain generates the full value for you, including your workspace's unique rua= reporting address — copy it from the wizard with the copy button rather than retyping it. p=none is the right starting policy: it monitors everything and blocks nothing.

Step by step

1. Sign in at dash.cloudflare.com and select the zone (domain) you're adding the record to.
2. Open the zone's DNS → Records section.
3. Press Add record.
4. Set Type to TXT.
5. In Name, type _dmarc — just that. Cloudflare appends the zone automatically, so _dmarc becomes _dmarc.example.com. Some DNS panels double the domain if you paste the full name; Cloudflare normalises it, but the bare label is the documented form.
6. In Content, paste your v=DMARC1; … value.
7. Leave TTL on Auto and press Save.

One Cloudflare-specific note: the orange-cloud proxy toggle you see on other records doesn't apply here. Proxying is for web traffic (A, AAAA, CNAME records); TXT records are always served as plain DNS, so there is no proxied-versus-DNS-only decision to make and nothing Cloudflare's proxy can interfere with.

Cloudflare's own nameservers answer with the new record almost immediately — one of the perks of managing DNS there. Resolvers elsewhere may hold a cached "no such record" answer briefly, but with a fresh name like _dmarc that's rarely more than minutes.

Verify it's live

From a terminal:

dig TXT _dmarc.example.com +short

You should see your v=DMARC1; … value echoed back in quotes. No terminal handy? Run your domain through the free DMARC checker — it fetches the live record and validates the syntax, which dig won't do. And if you added the record as part of DMARCmetric onboarding, press Verify DNS in the wizard; Verify your domain explains each result it can give you.

Common mistakes

• Adding your own quote marks. DNS tools display TXT values wrapped in quotes, but you should paste the raw value into Cloudflare's Content field — starting with v=DMARC1, no leading ". Pasting a quoted string publishes the quotes as literal characters and breaks parsing.
• Two _dmarc records. A domain may have only one DMARC record; receivers treat two TXT records at _dmarc as no valid policy at all. If a record already exists (an old monitoring vendor, a colleague's earlier attempt), edit it — don't add a second. Cloudflare will happily save both, so this one's on you to check.
• Publishing at the wrong name. The record lives at _dmarc on the domain in your From addresses — not at the root, not on www. Type the bare _dmarc label; Cloudflare handles the rest. (Some other DNS panels double the domain when you type the full hostname — that's their quirk, covered in the GoDaddy walkthrough.)
• Editing the value by hand. A missing semicolon between tags, mailto; instead of mailto:, or a mangled reporting address all invalidate the record or send your reports nowhere. Copy-paste the whole value, then confirm with the checker.

That's the entire job. If some of your domains live at other providers, the same record works everywhere — the GoDaddy walkthrough covers that panel's quirks.