---
title: "Cloudflare DNS"
description: "Add Mailfully's six sending records in Cloudflare, with the orange-cloud proxy switched off so the DKIM CNAMEs still resolve."
last_reviewed: "2026-09-17"
---

> **For AI agents:** the complete documentation index is at [llms.txt](/docs/llms.txt). Append `.md` to any page URL for its markdown version.

In Cloudflare, the six records live under your domain's DNS tab: open the zone, choose DNS, then Records, and use Add record for each value Mailfully returned. Field names below are current as of September 2026.

## Add the records

<Steps>
<Step title="Add the three DKIM CNAMEs">

Mailfully returns three DKIM tokens, and each one needs its own record:

| Field | Value |
|---|---|
| Type | CNAME |
| Name | `<token>._domainkey.mail` |
| Target | `<token>.dkim.amazonses.com` |
| TTL | Auto |

Before saving, confirm the record will land at `<token>._domainkey.mail.acme.com`, not at that name with `.acme.com` appended a second time.

</Step>
<Step title="Add the MAIL FROM MX record">

| Field | Value |
|---|---|
| Type | MX |
| Name | `send.mail` |
| Mail server | `feedback-smtp.us-east-1.amazonses.com` |
| Priority | 10 |

</Step>
<Step title="Add the MAIL FROM SPF record">

| Field | Value |
|---|---|
| Type | TXT |
| Name | `send.mail` |
| Content | `v=spf1 include:amazonses.com ~all` |

</Step>
<Step title="Add the DMARC record">

| Field | Value |
|---|---|
| Type | TXT |
| Name | `_dmarc.mail` |
| Content | `v=DMARC1; p=none;` |

</Step>
</Steps>

## Turn the proxy off

Cloudflare can proxy any CNAME through its own network, shown as an orange cloud next to the record. A proxied DKIM CNAME resolves to one of Cloudflare's addresses instead of `<token>.dkim.amazonses.com`, so the DKIM lookup Amazon SES performs finds the wrong target and the record never verifies. Set every DKIM CNAME, and the optional tracking CNAME if you use one, to DNS only (grey cloud). MX and TXT records have no proxy toggle at all, so the MX, SPF, and DMARC records are unaffected either way.

## If you use Cloudflare Email Routing

Email Routing manages MX records for whichever name it is enabled on, and defaults to your zone's apex, `acme.com`. Mailfully's MX record sits on `send.mail.acme.com`. With Email Routing left on the apex those are different names and neither setup needs to change. Cloudflare also supports enabling Email Routing on a subdomain, so if you have done that, check it is not `send.mail.acme.com` before you publish. If mail stops resolving after a DNS change, work through [Publishing your DNS records](/dns/overview) to isolate which record is at fault before assuming Email Routing is involved. See [MX record conflicts](/troubleshooting/mx-record-conflicts) if you're trying to tell the two records apart.

## Verify

```bash
dig +short <token>._domainkey.mail.acme.com CNAME
dig +short send.mail.acme.com MX
dig +short send.mail.acme.com TXT
dig +short _dmarc.mail.acme.com TXT
```

The DKIM lookups are the ones to read closely here, since a proxied record answers with a Cloudflare address rather than the SES target. [Verify with dig](/dns/overview#verify-with-dig) lists the expected answer for each lookup.