Add or Update a DMARC Record in Cloudflare DNS

Add DMARC in Cloudflare only when Cloudflare serves the domain’s authoritative DNS. A DMARC record requests handling/reporting associated with authentication aligned to the visible From domain; it does not itself sign messages, authorize an outbound server or make every email trustworthy.

Choose a policy from evidence

Inventory real sending services and inspect SPF/DKIM alignment before enforcement. Preserve an existing policy and its report settings. A new monitoring record can help observation, but replacing an existing reject policy with none is a security-policy change requiring deliberate review.

Create or edit the TXT record

1. Sign in through the verified Cloudflare dashboard and choose the correct zone. Confirm account/zone permissions and authoritative nameservers.
2. Open DNS > Records. Search for the domain’s existing DMARC record before adding another one.
3. Choose TXT and the owner _dmarc for the zone’s domain, or the appropriate subdomain owner for a specific subdomain policy. Check the effective full name; interfaces can append the zone suffix.
4. Enter the reviewed text in the content/value field and save. Do not expect the old “click to configure” popup in every dashboard version.
5. Inspect the final record and verify authoritative TXT responses rather than treating the save notification as a mail-authentication test.

A minimal monitoring value, without a reporting request, is:

v=DMARC1; p=none

For aggregate reports, use a reporting address you control or a deliberately authorized reporting service, with appropriate retention/access protections. External reporting can require DNS authorization. Do not copy another organization’s report mailbox or publish private customer addresses in examples.

Verify aligned authentication and reports

Send harmless authorized messages through every legitimate source and inspect trusted receiver authentication results. Either SPF or DKIM must pass and align as required; a technical pass for an unrelated domain is insufficient. Forwarding or content changes can complicate the result.

Quarantine/reject are requested policies, not guarantees of a particular folder or SMTP outcome. Current RFC 9989 removed the legacy percentage tag; do not infer a precise protection rate from an old pct value. Consider receiver compatibility and actual reports before changing enforcement. Missing reports alone do not prove a legitimate sender was cut off.

Use least-privilege account membership if authorized support assistance is required. Never share your Cloudflare password; verify the requested helper identity through your support ticket and remove temporary access afterward.

References: Cloudflare DNS record management and DMARC policy/alignment and current tags.

Reviewed October 15, 2026. Only synthetic record syntax/publication was checked; no Cloudflare account, customer DNS or mail policy was changed.