Dmarc Management

DNS lookup limit

An SPF record lists which servers are authorized to send email for your domain. SPF records can reference other domains and services (for example, using include: or mx mechanisms), and each such reference requires a separate DNS lookup to verify. The SPF specification (RFC 7208) limits the total number of these lookups to 10 per SPF check. If your SPF record exceeds this limit, receiving mail servers may treat the SPF check as a permanent error and reject or flag your emails.

To check if your SPF records are compliant with the SPF specification:

  1. Log in to the Cloudflare dashboard, and select your account and domain.
  2. Go to Email > DMARC Management.
  3. In Email record overview, select View records.
  4. Find your SPF record, and select the three dots next to it > Edit.
  5. DMARC Management will inspect your records and check for the total number of DNS lookups. If the record exceeds the limit, DMARC Management will display a warning. To fix this, remove unnecessary entries in your SPF record. Refer to Manage DNS records for more information.

Enable DMARC Management

import { GlossaryTooltip } from "~/components";

You need to enable DMARC Management to allow Cloudflare to process DMARC reports on your behalf. DMARC Management only works with apex domains (for example, example.com, not blog.example.com) and not domains in subdomain setups.

:::caution[A warning on DMARC Management and SPF records] DMARC Management does not support modifications to SPF records when a CNAME record in your zone points to an external domain. Any changes to the SPF record could invalidate your DMARC policy, as Cloudflare cannot update the associated external DNS records. We recommend managing SPF updates directly through the external domain's DNS provider. :::

To enable DMARC Management:

  1. Log in to the Cloudflare dashboard, and select your account and domain.
  2. Go to Email > DMARC Management.
  3. Select Enable DMARC Management.
  4. DMARC Management will scan your zone for DMARC records, and will present you with two outcomes:
    • If no DMARC record is found, Cloudflare will automatically invite you to add one that you can edit later. Select Add to continue.
    • If a DMARC record is found in your zone, Cloudflare will add another rua (Reporting URI for Aggregate data) entry to it. The rua tag specifies the URI (typically a mailto: address) where aggregate DMARC reports are sent. This additional entry uses a Cloudflare email address so that Cloudflare can receive and process DMARC reports on your behalf. Select Next to continue.

DMARC Management (beta) is now active. However, it may take up to 24 hours to receive your first DMARC report and to display this information in DMARC Management.

Cloudflare DMARC Management

import { Description, Plan, RelatedProduct } from "~/components";

Stop brand impersonation.

When someone receives an email that claims to be from your domain, email servers check whether that message is authentic. Three DNS-based mechanisms handle this verification:

Cloudflare DMARC Management helps you track every source that is sending emails from your domain and review DMARC reports for each source. These reports show whether messages sent from your domain are passing SPF, DKIM, and DMARC checks — so you can identify unauthorized senders and protect your domain from being used in phishing or spoofing attacks.

:::note DMARC Management is available to all Cloudflare customers with Cloudflare DNS. :::

<RelatedProduct header="Email security" href="/cloudflare-one/email-security/" product="email-security"

Protect your email inbox with Email security.
Fast, resilient and easy-to-manage DNS service.

Security records

import { Render } from "~/components";

Create security records

To set up email security records:

  1. Log in to the Cloudflare dashboard, and select your account and domain.
  2. Go to Email > DMARC Management.
  3. In Email record overview, select View records.
  4. Use the available options to set up SPF, DKIM, and DMARC records. This page will also list any previous records you might already have in your account.

Edit or delete records

Refer to Manage DNS records for more information.

Statistics and details

DMARC Management (beta) allows you to review whether emails sent on your behalf passed or failed DMARC, SPF, and DKIM authentication checks.

  1. Log in to the Cloudflare dashboard, and select your account and domain.
  2. Go to Email > DMARC Management.
  3. The graph shows the volume of emails over a selected time period. Use the dropdown to select a period of up to 30 days.
  4. Moving your mouse through the graph gives you details for a particular day. Select View reports for a list of DMARC reports by date.
  5. Select one of the dates shown to open a window with more details.

Source details

The Top 10 sources section shows you details about the top sources sending emails on your behalf, with information such as total volume of emails and how these sources fared regarding security policies.

You also have access to information about all third parties, and can drill down for further details on each of them:

  1. Log in to the Cloudflare dashboard, and select your account and domain.
  2. Go to Email > DMARC Management.
  3. Select View all.
  4. The next page shows you a list of all sources sending email on your behalf. You can filter this list by time period.
  5. Find a source you want to inspect further, and select the three dots in front of it > Details to learn more about that third party.