> For the complete documentation index, see [llms.txt](https://docs.yeymail.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.yeymail.com/using-yeymail/custom-domains/cloudflare.md). # Cloudflare Cloudflare is the most common place our customers keep their DNS, and it has one trap that silently swallows every incoming message. Read the first section before you add anything. ## Before you start: Email Routing If you have ever switched on Cloudflare **Email Routing** for this domain, Cloudflare owns the domain's MX records and marks them **Locked**. You cannot edit or delete them from the DNS page, and Cloudflare states plainly that Email Routing cannot be used with an external mail server. Leave those records in place and senders keep delivering to `route1.mx.cloudflare.net`. We never see the mail. There is no bounce and no error anywhere, so this looks exactly like "YeyMail is broken". Go to **Compute → Email Service → Email Routing**, pick the domain, open **Settings**, then either: * **Unlock** each record in the DNS records section (keeps your existing forwarding alive while you cut over), or * **Disable Email Routing** and confirm (removes the MX, SPF and DKIM records Cloudflare added). Records on the `cf-bounce` subdomain stay managed by Cloudflare. Leave them alone; they do not affect inbound mail for your root domain. ## Add the records 1. Open your domain in Cloudflare and go to **DNS → Records**. 2. Delete any existing MX records on the root domain. A leftover MX pointing at a previous provider will keep taking your mail: a lower priority number wins, so adding ours alongside is not enough. 3. Select **Add record** and fill in one row per record from your domain's DNS tab in YeyMail: * **Type**: `MX`, or `TXT` for SPF, DKIM and DMARC * **Name**: `@` for the root domain. Cloudflare will display the saved row as your full domain rather than `@`; that is display only, not a second record. * **Priority**: MX only, its own numeric field. Do not type the number into the mail server box. * **TTL**: leave on **Auto** 4. Save, then repeat for each record. Both MX records go in, `mx1` at priority 10 and `mx2` at priority 20. Copy each value from the DNS tab of your domain in YeyMail rather than from a guide. Paste the exact value shown there, and the page shows a live tick once we can see each record. ## Things that look wrong but are not **There is no orange cloud on your MX or TXT records.** Only A, AAAA and CNAME records can be proxied; MX and TXT are always DNS-only. There is nothing to switch off, and the missing toggle does not mean you did it wrong. **`_dc-mx.` appears in a DNS lookup.** If a mail hostname is also proxied for web traffic, Cloudflare inserts that label into MX responses. It is Cloudflare's own proxy-bypass mechanism, not a hijack, and it will not appear in your records table. ## Things that really are wrong **A proxied (orange cloud) A record that a mail hostname points at.** SMTP does not work through Cloudflare's HTTP proxy; senders would connect to a Cloudflare edge that is not listening for mail. Any A or AAAA record used for mail must be **DNS only**. Keep your mail hostname separate from your website hostname so the website can stay proxied. **Two `v=spf1` records.** Receivers do not merge them; two is a permanent failure that breaks authentication for mail you send. If the root domain already has an SPF record, **edit that one** and add our `include:` to it rather than adding a second TXT record. **Quotes around TXT values.** Cloudflare adds the quotes itself. Paste SPF, DKIM and DMARC values without them. Pasting pre-quoted text can end up double-quoted, which breaks SPF parsing and DKIM verification while mail still arrives, so everything lands in spam and nothing looks broken. **Editing DNS on a partial (CNAME) setup.** Check that your domain's nameservers actually end in `ns.cloudflare.com`. If they point somewhere else, Cloudflare is not authoritative for your domain and the records belong at whichever provider your nameservers name. ## Check it worked Wait for propagation, then press **Verify records** on the domain's DNS tab. We re-check automatically as well, and email you when everything passes. Trust an external lookup over the Cloudflare UI: an MX query on your domain should return both of our hostnames, and a TXT query should return exactly one `v=spf1` string. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.yeymail.com/using-yeymail/custom-domains/cloudflare.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.