> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://www.agentmail.to/docs/llms.txt.

# DNS Guide: Cloudflare

## Steps

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com)
2. Select your domain
3. Go to **DNS**, then click **Records**
4. Click **Add Record** for each record AgentMail requires

## Records to add

AgentMail returns the exact records for your domain in the [AgentMail Console](https://console.agentmail.to) and in the `records` array of the [Create Domain](https://docs.agentmail.to/api-reference/domains/create) response. Always copy the values shown for your domain. For a US-region domain named `example.com`, the full set looks like this:

| Purpose             | Type  | Name (host)             | Value                                               | Priority |
| ------------------- | ----- | ----------------------- | --------------------------------------------------- | -------- |
| Receiving           | `MX`  | `@`                     | `inbound-smtp.us-east-1.amazonaws.com`              | `10`     |
| Bounces (MAIL FROM) | `MX`  | `mail`                  | `feedback-smtp.us-east-1.amazonses.com`             | `10`     |
| SPF (MAIL FROM)     | `TXT` | `mail`                  | `v=spf1 include:amazonses.com -all`                 |          |
| DKIM                | `TXT` | `<selector>._domainkey` | `v=DKIM1; k=rsa; p=...` (your public key)           |          |
| DMARC               | `TXT` | `_dmarc`                | `v=DMARC1; p=reject; rua=mailto:dmarc@agentmail.to` |          |

* **SPF lives on `mail.example.com`, not your root domain.** AgentMail sends with a custom MAIL FROM subdomain, and SPF is checked against that hostname. Do not add anything to an existing SPF record on your root domain (for example one for Google Workspace or Microsoft 365).
* **The `mail` MX must be the only MX record at `mail.example.com`.** If another MX record exists at that host, verification reports `duplicate_records`. This record carries bounces and complaints; it does not receive inbox mail.
* **DMARC needs a reporting address.** If `_dmarc.example.com` already has a DMARC record, keep that single record instead of adding a second one, and make sure it includes a `rua=mailto:` tag.
* **DKIM needs exactly one TXT record at the selector host.** Remove any older record at the same selector.
* **Send-only domains:** create the domain with `inbound_enabled` set to `false` and the receiving MX is left out, so your existing provider keeps receiving mail.
* **Region:** EU-region domains use `eu-central-1` in the MX values in place of `us-east-1`.
* **Subdomains:** names are relative to your DNS zone. For `agents.example.com`, the hosts become `agents`, `mail.agents`, `_dmarc.agents`, and `<selector>._domainkey.agents`.
* **Optional records:** a `link` CNAME is added when `tracking_enabled` is on, and a wildcard `*` MX when `subdomains_enabled` is on.
* **Older domains** may show three DKIM `CNAME` records (`<token>._domainkey` pointing to `<token>.dkim.amazonses.com`) instead of one DKIM TXT record. Keep them if they already verify.

## Adding the TXT records (SPF, DKIM, DMARC)

Add one TXT record for each row below:

| Record | Name                                                                | Content                        |
| ------ | ------------------------------------------------------------------- | ------------------------------ |
| SPF    | `mail`                                                              | The SPF value from AgentMail   |
| DKIM   | The DKIM selector host from AgentMail (e.g., `selector._domainkey`) | The DKIM value from AgentMail  |
| DMARC  | `_dmarc`                                                            | The DMARC value from AgentMail |

Set **Type** to `TXT` and **TTL** to `Auto` for each one.

Cloudflare adds your domain to the Name field for you. Enter only the host portion (e.g., `selector._domainkey`), not the full `selector._domainkey.yourdomain.com`.

> **Warning**
>
> Do **not** add anything to an existing SPF record on your root domain (`@`). AgentMail's SPF record goes on the `mail` host, which is a different hostname, so your existing SPF for Google Workspace or another service stays exactly as it is.

> **Note**
>
> Legacy orgs should keep existing working DNS records in place. For new domain setup, add the TXT selector records shown in AgentMail.

## Adding the MX records (receiving and bounces)

Add one MX record for each row below:

| Record              | Name   | Mail server                                 | Priority |
| ------------------- | ------ | ------------------------------------------- | -------- |
| Receiving           | `@`    | The receiving MX value from AgentMail       | `10`     |
| Bounces (MAIL FROM) | `mail` | The `feedback-smtp` MX value from AgentMail | `10`     |

Set **TTL** to `Auto`. Skip the receiving MX if you created the domain as send-only (`inbound_enabled: false`). The `mail` MX must be the only MX record on the `mail` host.

If you registered a subdomain such as `agents.yourdomain.com` to avoid conflicts with your existing email provider, add the subdomain to every name: `agents`, `mail.agents`, `_dmarc.agents`, and `selector._domainkey.agents`.

## Verification

After adding all records, go back to the [AgentMail Console](https://console.agentmail.to) and click **Verify Domain**.

Cloudflare DNS typically propagates within **1 to 5 minutes**, making it one of the fastest providers for DNS updates.

## Common Cloudflare Issues

* **Existing SPF record on your root domain:** Leave it unchanged. Do not add `include:agentmail.to` or any other AgentMail value to it. If an earlier guide told you to add `include:agentmail.to`, remove that mechanism: `agentmail.to` publishes no SPF record, so the include causes an SPF permanent error.

* **Duplicate TXT values:** Cloudflare lets you add TXT records with the same name, but duplicate SPF or stale DKIM selector records can make verification fail. Keep only the current values AgentMail provides for each host.

* **Name field:** Cloudflare adds your domain to the Name field automatically. If your DKIM selector is `selector._domainkey`, enter just that, then check that the saved record shows the name you expect before you verify.