MarkRelayGet MarkRelay

site.cloudflare.com: the DNS records for Email Routing and Email Sending

Every record Cloudflare adds for receiving and sending on your domain, what each does, and the fixes Cloudflare documents when mail stops arriving or lands in spam.

Published by
MarkRelay Research
Updated
Sources
4 primary sources, linked below

Summary

Email Routing needs the domain on Cloudflare DNS and adds three MX records (route1, route2 and route3.mx.cloudflare.net), an SPF record "v=spf1 include:_spf.mx.cloudflare.net ~all" and a DKIM record at cf2024-1._domainkey; they are locked after onboarding, and Email Routing cannot share the domain with another mail server's MX records. Email Sending signs with a DKIM key at cf-bounce._domainkey and uses an SPF record at the cf-bounce subdomain. Only one SPF record is allowed per name, and Cloudflare's guidance for DMARC is to start at p=none and tighten later. MarkRelay uses exactly these records: it runs on Email Routing and Email Sending, so setting up a domain for it is onboarding the domain in Cloudflare and pointing a rule at its Worker.

Key findings

  1. 1MX: route1.mx.cloudflare.net, route2.mx.cloudflare.net, route3.mx.cloudflare.net, with priorities assigned by Cloudflare.
  2. 2SPF for Email Routing at the root: v=spf1 include:_spf.mx.cloudflare.net ~all. Email Sending's SPF lives at the cf-bounce subdomain.
  3. 3DKIM: cf2024-1._domainkey for Email Routing, cf-bounce._domainkey for Email Sending.
  4. 4The records are locked after onboarding; existing MX records for another mail server must be removed, since Email Routing cannot be combined with external mail servers.
  5. 5Only one v=spf1 record is allowed; SPF must stay within 10 DNS lookups; DMARC needs SPF or DKIM alignment, and Cloudflare suggests starting at p=none.

Questions this report answers

Asked by real people, quoted as they wrote them.

“How to use cloudflare as my custom domain mail DNS”

r/CloudFlare, 11 comments

Move the domain's DNS to Cloudflare, then enable Email Routing: Cloudflare adds the MX, SPF and DKIM records and locks them. Remove any MX records that point at another mail server, since the two cannot be combined.

“Moved my domains to CloudFlare and now sent mail gets flagged as spam?”

r/CloudFlare

Check for a second SPF record: only one v=spf1 record is allowed, and Cloudflare's fix is to delete the extras and keep one that includes every service that sends for you. Then check that DKIM exists at the selector your sending service uses and that a DMARC record exists.

“cloudflare email routing not working”

Google and Bing search suggestion

Cloudflare lists the usual causes: multiple SPF records, an SPF record missing include:_spf.mx.cloudflare.net, a missing DKIM record at cf2024-1._domainkey, other MX records still present, and destinations that were never verified.

“Does Cloudflare's Email Routing have more stringent blocking policy than DMARC specification? Are there any ways to change this?”

r/CloudFlare, 11 comments

Cloudflare's troubleshooting guide covers the sender side: DMARC requires SPF or DKIM alignment, and if a strict policy causes problems it suggests starting at p=none and moving to quarantine and reject later. It does not document a setting to relax inbound filtering.

Records Cloudflare uses for your domain

MX

Name
yourdomain.com
Value
route1, route2, route3.mx.cloudflare.net
Used by
Email Routing

SPF (TXT)

Name
yourdomain.com
Value
v=spf1 include:_spf.mx.cloudflare.net ~all
Used by
Email Routing

DKIM (TXT)

Name
cf2024-1._domainkey
Value
Key provided by Cloudflare
Used by
Email Routing

SPF (TXT)

Name
cf-bounce
Value
Provided at onboarding
Used by
Email Sending

DKIM (TXT)

Name
cf-bounce._domainkey
Value
Key provided by Cloudflare
Used by
Email Sending

DMARC (TXT)

Name
_dmarc
Value
You add it; start at p=none
Used by
Both

The Email Routing records are locked after onboarding; unlock them under DNS → Records before editing. Source: Email Routing DNS records, Troubleshooting.

Setting up a domain: by hand vs with MarkRelay

DNS on Cloudflare

Email Routing to Gmail
Yes
MarkRelay
Yes

Records for receiving

Email Routing to Gmail
Added by Email Routing
MarkRelay
Added by Email Routing

Records for sending

Email Routing to Gmail
From your SMTP provider, for Gmail Send as until January 2027
MarkRelay
Added by Email Sending

Routing rule

Email Routing to Gmail
One per address, to a verified destination
MarkRelay
One catch-all to the MarkRelay Worker

New address later

Email Routing to Gmail
New rule and destination
MarkRelay
New mailbox in MarkRelay; DNS and rules unchanged

How MarkRelay fits on top of these records

MarkRelay does not add DNS records of its own. Receiving uses the Email Routing MX, SPF and DKIM records; sending uses the Email Sending records at cf-bounce. Connecting a domain means onboarding it to both in the Cloudflare dashboard and pointing a catch-all rule, or individual address rules, at the MarkRelay Worker.

After that, adding support@ or billing@ is a matter of creating the mailbox in MarkRelay: the catch-all rule already delivers every address to the Worker, which accepts the ones that have a mailbox and rejects the rest.

Where MarkRelay fits

A good fit when

  • Domains already on Cloudflare DNS that should receive and send without another mail host.
  • Adding addresses often, without editing routing rules each time.

Look elsewhere when

  • Domains that must keep another provider's MX records: Email Routing cannot share the domain.
  • Domains whose DNS stays with another provider.

Common questions

What MX records does Cloudflare Email Routing use?

route1.mx.cloudflare.net, route2.mx.cloudflare.net and route3.mx.cloudflare.net, with priorities set by Cloudflare.

Can I have two SPF records?

No. Only one v=spf1 record is allowed; merge the include: entries of every sender into it.

Sources and method

  1. Email Routing DNS records (developers.cloudflare.com/email-routing/setup/email-routing-dns-records/)
  2. Enable Email Routing (developers.cloudflare.com/email-routing/get-started/enable-email-routing/)
  3. Troubleshooting (developers.cloudflare.com/email-routing/troubleshooting/)
  4. Email Routing limits (developers.cloudflare.com/email-routing/limits/)

Facts are taken from each vendor's own pricing pages, documentation or terms as of the updated date above; prices are in US dollars per month unless stated. Cost comparisons apply each vendor's published rates to the same volume. MarkRelay is not affiliated with Cloudflare;"site.cloudflare.com" in the title names the site these facts come from. MarkRelay sells a self-hosted email app, which this page mentions where it fits. Spotted something outdated? Tell us.

Revisions

  • : First published; every fact checked on the vendor's own pages.

Related guides

More research