Skip to content
Cloudflare Docs
Docs DirectoryAPIsSDKs

Domain configuration

Configure domains for Cloudflare Email Service, manage DNS records, and verify domain setup for both email sending and routing.

Configure your domains to work with Cloudflare Email Service. This includes DNS record management, domain verification, and advanced domain settings.

Automatic DNS configuration

You can quickly get your DNS configured by following the automatic DNS configuration flow as part of the onboarding onto Email Service.

  1. Log in to the Cloudflare Dashboard ↗.

  2. Navigate to Compute > Email Service > Email Sending or Email Routing.

  3. Select Onboard Domain.

  4. Choose a domain from your Cloudflare account.

  5. Select Next to configure DNS records.

  6. Press Add records and onboard. This will add the following DNS records to your domain:

    • TXT records for SPF to authorize sending emails and routing forwarded emails.
    • TXT records for DKIM to provide authentication for emails sent and forwarded from your domain.
    • MX records to route incoming emails to Email Service.

DNS record configuration details

Cloudflare automatically configures required DNS records for both email sending and routing when you onboard a domain onto Email Service. Here are the specific details of the DNS records configured:

Sending records

These records authenticate your outbound emails. Email Sending creates DNS records on a cf-bounce. subdomain of your domain to handle bounce processing. These are separate from the records used by Email Routing.

Purpose: Route bounce emails back to Cloudflare for processing.

MX cf-bounce.yourdomain.com route1.mx.cloudflare.net
MX cf-bounce.yourdomain.com route2.mx.cloudflare.net
MX cf-bounce.yourdomain.com route3.mx.cloudflare.net

Configuration:

  • Type: MX
  • Name: cf-bounce (subdomain)
  • Mail server: Cloudflare MX servers
  • Priority: Assigned automatically by Cloudflare

Routing records

These records route incoming emails to Cloudflare and authenticate forwarded emails. Email Routing DNS records are configured on the root domain.

Purpose: Route incoming emails to Cloudflare's mail servers.

MX yourdomain.com route1.mx.cloudflare.net
MX yourdomain.com route2.mx.cloudflare.net
MX yourdomain.com route3.mx.cloudflare.net

Configuration:

  • Type: MX
  • Name: @ (root domain)
  • Mail server: Cloudflare routing MX servers
  • Priority: Assigned automatically by Cloudflare

Domain verification

Email Sending and Email Routing have separate DNS records and separate settings pages where you can verify their status.

Verify Email Sending records

  1. Go to Compute > Email Service > Email Sending > Settings.
  2. The DNS records section shows all sending-related records:
    • MX records on cf-bounce.yourdomain.com
    • SPF record on cf-bounce.yourdomain.com
    • DKIM record on cf-bounce._domainkey.yourdomain.com
    • DMARC record on _dmarc.yourdomain.com
  3. Each record shows a Locked status when properly configured.

Verify Email Routing records

  1. Go to Compute > Email Service > Email Routing > Settings.
  2. The DNS records section shows all routing-related records:
    • MX records on yourdomain.com
    • SPF record on yourdomain.com
    • DKIM record on cf2024-1._domainkey.yourdomain.com
  3. Each record shows a Locked status when properly configured.

If records are not configured

  • Wait 5-15 minutes for DNS propagation.
  • Check DNS configuration in your domain's DNS > Records settings.

Verification troubleshooting

Issue: Records show as "Not Found" immediately after adding.

Solution:

  • Wait 5-15 minutes for DNS propagation
  • Check propagation status: dig TXT yourdomain.com
  • Cloudflare domains propagate faster than external domains

Check propagation globally:

Terminal window
# Check sending SPF record
dig TXT cf-bounce.yourdomain.com | grep spf


# Check routing SPF record
dig TXT yourdomain.com | grep spf


# Check sending DKIM record
dig TXT cf-bounce._domainkey.yourdomain.com


# Check routing DKIM record
dig TXT cf2024-1._domainkey.yourdomain.com


# Check routing MX records
dig MX yourdomain.com


# Check sending MX records (bounce handling)
dig MX cf-bounce.yourdomain.com

Domain management

Remove a domain

  1. Go to Compute > Email Service > Email Sending > Settings.
  2. Select the domain to remove.
  3. Select Remove Domain.
  4. Confirm removal.

Domain Removal Impact

Removing a domain will:

  • Stop all email sending from that domain
  • Disable email routing for that domain
  • Require reconfiguration if re-added

DNS record management

When you remove a domain from Email Service, you have two options for handling the DNS records:

Option 1: Remove all records

This removes all Email Service DNS records from your domain:

  • All SPF, DKIM, and MX records for Email Service are deleted
  • Your domain will no longer receive or send emails through Email Service
  • If you want to use Email Service again in the future, you will need to onboard the domain and add all records from scratch

Option 2: Keep records

This keeps the DNS records in place but disables Email Service:

  • DNS records remain in your domain configuration
  • Email Service stops processing emails for the domain
  • You can re-enable Email Service by onboarding the domain again
  • DNS records that were automatically added will remain locked to prevent accidental deletion

To modify locked records after removal:

  1. Go to your domain's DNS > Records.
  2. Find the locked Email Service records.
  3. Select the record and choose Edit.
  4. Toggle Unlock record to enable editing.
  5. Make your changes and save.

Transfer domain ownership

  1. Domain must remain in the same Cloudflare account.
  2. DNS records are tied to the account, not specific users.
  3. Use Cloudflare account-level permissions to manage access.

Next steps