DNS Guide: Cloudflare

Steps

1. Log in to the Cloudflare dashboard
2. Select your domain
3. Go to DNS, then click Records
4. Click Add Record for each record AgentMail requires

Records to add

AgentMail returns the exact records for your domain in the AgentMail Console and in the records array of the Create Domain response. Always copy the values shown for your domain. For a US-region domain named example.com, the full set looks like this:

• SPF lives on mail.example.com, not your root domain. AgentMail sends with a custom MAIL FROM subdomain, and SPF is checked against that hostname. Do not add anything to an existing SPF record on your root domain (for example one for Google Workspace or Microsoft 365).
• The mail MX must be the only MX record at mail.example.com. If another MX record exists at that host, verification reports duplicate_records. This record carries bounces and complaints; it does not receive inbox mail.
• DMARC needs a reporting address. If _dmarc.example.com already has a DMARC record, keep that single record instead of adding a second one, and make sure it includes a rua=mailto: tag.
• DKIM needs exactly one TXT record at the selector host. Remove any older record at the same selector.
• Send-only domains: create the domain with inbound_enabled set to false and the receiving MX is left out, so your existing provider keeps receiving mail.
• Region: EU-region domains use eu-central-1 in the MX values in place of us-east-1.
• Subdomains: names are relative to your DNS zone. For agents.example.com, the hosts become agents, mail.agents, _dmarc.agents, and <selector>._domainkey.agents.
• Optional records: a link CNAME is added when tracking_enabled is on, and a wildcard * MX when subdomains_enabled is on.
• Older domains may show three DKIM CNAME records (<token>._domainkey pointing to <token>.dkim.amazonses.com) instead of one DKIM TXT record. Keep them if they already verify.

Adding the TXT records (SPF, DKIM, DMARC)

Add one TXT record for each row below:

Set Type to TXT and TTL to Auto for each one.

Cloudflare adds your domain to the Name field for you. Enter only the host portion (e.g., selector._domainkey), not the full selector._domainkey.yourdomain.com.

Adding the MX records (receiving and bounces)

Add one MX record for each row below:

Set TTL to Auto. Skip the receiving MX if you created the domain as send-only (inbound_enabled: false). The mail MX must be the only MX record on the mail host.

If you registered a subdomain such as agents.yourdomain.com to avoid conflicts with your existing email provider, add the subdomain to every name: agents, mail.agents, _dmarc.agents, and selector._domainkey.agents.

Verification

After adding all records, go back to the AgentMail Console and click Verify Domain.

Cloudflare DNS typically propagates within 1 to 5 minutes, making it one of the fastest providers for DNS updates.

Common Cloudflare Issues

• Existing SPF record on your root domain: Leave it unchanged. Do not add include:agentmail.to or any other AgentMail value to it. If an earlier guide told you to add include:agentmail.to, remove that mechanism: agentmail.to publishes no SPF record, so the include causes an SPF permanent error.

• Duplicate TXT values: Cloudflare lets you add TXT records with the same name, but duplicate SPF or stale DKIM selector records can make verification fail. Keep only the current values AgentMail provides for each host.

• Name field: Cloudflare adds your domain to the Name field automatically. If your DKIM selector is selector._domainkey, enter just that, then check that the saved record shows the name you expect before you verify.