dmarc PROTOCOLHost: Cloudflare DNSStandard: RFC 7489
How to Configure Domain-based Message Authentication, Reporting, and Conformance (DMARC) on Cloudflare DNS
Enforces receiver policy (none, quarantine, reject) when SPF and/or DKIM alignment fails, and generates forensic aggregate reports. Follow this verified implementation guide to deploy standard compliant DMARC DNS records in Cloudflare DNS.
Default DMARC Record Syntax
// Authoritative RFC Example
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com; pct=100; aspf=r; adkim=rConfiguration Steps in Cloudflare DNS
- 1Log in to the Cloudflare Dashboard and select your domain.
- 2Navigate to the "DNS" -> "Records" management panel.
- 3Locate the dangling CNAME/record for the orphaned subdomain.
- 4Click "Edit" and either update the target to an active resource or click "Delete" to remove it.
- 5Verify that Cloudflare Proxy (Orange Cloud) is enabled if HTTP proxying is required.
Verification Checklist (RFC 7489)
Query DNS TXT record at _dmarc.yourcompany.com.
Ensure valid "p=" policy exists (transition from p=none to p=quarantine to p=reject).
Verify "rua=" tag points to an authenticated inbox or monitoring service.
Check alignment modes (aspf and adkim default to relaxed "r").
Live Validation Engine
Run Free DNS ValidatorValidate Your Cloudflare DNS DMARC Record
Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.