Cloudflare DNS

In Cloudflare, the six records live under your domain's DNS tab: open the zone, choose DNS, then Records, and use Add record for each value Mailfully returned. Field names below are current as of September 2026.

Add the records

Add the three DKIM CNAMEs

Mailfully returns three DKIM tokens, and each one needs its own record:

Field	Value
Type	CNAME
Name	`<token>._domainkey.mail`
Target	`<token>.dkim.amazonses.com`
TTL	Auto

Before saving, confirm the record will land at <token>._domainkey.mail.acme.com, not at that name with .acme.com appended a second time.

Add the MAIL FROM MX record

Field	Value
Type	MX
Name	`send.mail`
Mail server	`feedback-smtp.us-east-1.amazonses.com`
Priority	10

Add the MAIL FROM SPF record

Field	Value
Type	TXT
Name	`send.mail`
Content	`v=spf1 include:amazonses.com ~all`

Add the DMARC record

Field	Value
Type	TXT
Name	`_dmarc.mail`
Content	`v=DMARC1; p=none;`

Turn the proxy off

Cloudflare can proxy any CNAME through its own network, shown as an orange cloud next to the record. A proxied DKIM CNAME resolves to one of Cloudflare's addresses instead of <token>.dkim.amazonses.com, so the DKIM lookup Amazon SES performs finds the wrong target and the record never verifies. Set every DKIM CNAME, and the optional tracking CNAME if you use one, to DNS only (grey cloud). MX and TXT records have no proxy toggle at all, so the MX, SPF, and DMARC records are unaffected either way.

If you use Cloudflare Email Routing

Email Routing manages MX records for whichever name it is enabled on, and defaults to your zone's apex, acme.com. Mailfully's MX record sits on send.mail.acme.com. With Email Routing left on the apex those are different names and neither setup needs to change. Cloudflare also supports enabling Email Routing on a subdomain, so if you have done that, check it is not send.mail.acme.com before you publish. If mail stops resolving after a DNS change, work through Publishing your DNS records to isolate which record is at fault before assuming Email Routing is involved. See MX record conflicts if you're trying to tell the two records apart.

Verify

dig +short <token>._domainkey.mail.acme.com CNAME
dig +short send.mail.acme.com MX
dig +short send.mail.acme.com TXT
dig +short _dmarc.mail.acme.com TXT

The DKIM lookups are the ones to read closely here, since a proxied record answers with a Cloudflare address rather than the SES target. Verify with dig lists the expected answer for each lookup.