Can Cloudflare break email DNS setups?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
If you manage your domain through Cloudflare, you've probably noticed that little orange cloud toggle. It's a great feature for web traffic. For email DNS, it's a trap if you leave it on the wrong records.
The short answer is that Cloudflare doesn't break email. Incorrect proxy settings do. The two are not the same thing.
Here's what's actually happening. When you proxy a record through Cloudflare (orange cloud), traffic routes through Cloudflare's network first. That's perfect for your website's A records because Cloudflare can cache, protect, and accelerate that traffic. But SMTP (the protocol that delivers email) is not web traffic. Cloudflare's proxy doesn't handle it, so if your mail server's A record is proxied, incoming connections hit Cloudflare's edge instead of your actual mail server. Mail fails.
What to keep DNS-only (gray cloud):
- MX records (Cloudflare won't even let you proxy these, but worth knowing why)
- A records for your mail server hostname
- TXT records for SPF, DKIM, and DMARC
- CNAME records used for DKIM selectors
What's fine to proxy (orange cloud):
- A records for your website (your homepage, landing pages, and so on)
- AAAA records serving web content
The most common mistake is proxying the A record for something like mail.yourdomain.com. Your MX record points to that hostname. When a receiving server tries to connect for delivery, it resolves that hostname, hits Cloudflare's proxy IP, and the connection either times out or gets refused. Your mail server never even sees it.
TXT records are a separate concern. Cloudflare won't proxy them (they're read-only lookups), but it's worth double-checking that your SPF and DKIM records are publishing correctly after any DNS change. Propagation can take a few minutes to a few hours, and a propagation delay right after an edit can look a lot like a Cloudflare problem when it isn't.
And if something feels off after a Cloudflare change, you can check your live SPF record with our free SPF checker. Or if you're genuinely stuck, drop us a line and we'll take a look with you.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
