Your cold email infrastructure is broken if your DNS isn't set up correctly. This is the unsexy part that most people skip - and it's also the part that determines whether your emails land in inboxes or the spam folder.
Cloudflare DNS is a common choice for managing your domain's DNS records because it's fast, reliable, and free. But most people setting up cold email don't configure it properly for email sending. They miss critical records, misconfigure SPF, or leave DKIM incomplete. Then they send 500 emails and wonder why only 12% land in inboxes.
This guide walks you through exactly what to set up in Cloudflare DNS to make sure your cold emails have the best chance of landing. We're talking about the records you actually need, the specific values you need to use, and how to verify each one works.
Why DNS Matters for Cold Email Deliverability
Email servers check your DNS records before accepting your email. They're looking for proof that you own the domain you're sending from and that you're legitimate. If those records are missing or wrong, email providers like Gmail and Outlook treat your emails as suspicious.
The three DNS records that matter for cold email are SPF, DKIM, and DMARC. Each one answers a different question:
- SPF (Sender Policy Framework) - "Is this server authorized to send email from this domain?"
- DKIM (DomainKeys Identified Mail) - "Did this domain actually send this email, or is someone forging it?"
- DMARC (Domain-based Message Authentication, Reporting and Conformance) - "What should I do if the above checks fail?"
Get these three right, and email providers will trust you. Get them wrong, and you're fighting an uphill battle with deliverability no matter how good your email copy is.
Step 1: Set Up Your SPF Record in Cloudflare
SPF tells email servers which mail servers are allowed to send emails on behalf of your domain. If you're using a sending service (like Amazon SES, SendGrid, or even Gmail), you need to add them to your SPF record.
Log into Cloudflare, navigate to your domain, and go to DNS. You're looking for existing TXT records. If you already have an SPF record, you'll see something that starts with "v=spf1". If not, you need to create one.
Here's the basic structure:
v=spf1 include:sendgrid.net ~all
This example tells email servers that SendGrid is authorized to send from your domain. The "~all" at the end means "soft fail" - accept emails from other servers but mark them as suspicious if something goes wrong.
If you're using multiple sending services, add them all:
v=spf1 include:sendgrid.net include:amazonses.com include:_spf.google.com ~all
In Cloudflare, create a TXT record with the name "@" (or your subdomain if you're using one) and paste the entire SPF string as the value. Save it and wait 15-30 minutes for it to propagate.
One important note: SPF records can only have one "all" modifier. If you already have an SPF record and need to add more services, you have to modify the existing record, not create a new one. Cloudflare will only use the last one if you create duplicates.
Step 2: Configure DKIM in Cloudflare
DKIM is more technical than SPF. It works by having your email sending service create a public key that email servers can check. Your DKIM record goes in DNS and proves that emails claiming to be from your domain actually came from you.
Most sending services handle DKIM for you. In SendGrid, for example, you go to Settings > Sender Authentication > Domain Authentication, enter your domain, and SendGrid generates the DKIM records for you.
You'll get something that looks like this in Cloudflare:
- Record type: CNAME
- Name: something like "sendgrid._domainkey" or "default._domainkey"
- Target: something like "sendgrid.domains.com"
Go back to your DNS in Cloudflare and create a CNAME record with exactly those values. Again, wait 15-30 minutes for propagation.
Once it's live, your sending service should have a verification button. Click it. It'll check that the record exists and is correct.
Step 3: Set Up DMARC
DMARC tells email servers what to do if SPF or DKIM fails. It's your safety net.
Create another TXT record in Cloudflare. The name should be "_dmarc" and the value should be:
v=DMARC1; p=quarantine; rua=mailto:[email protected]
This tells email servers to quarantine (hold in spam) emails that fail SPF and DKIM checks, and to send you reports about what failed at [email protected].
Start with "quarantine" instead of "reject" because reject will outright refuse emails that fail checks - which is safer but less forgiving if something goes wrong with your setup. After a week of monitoring reports and confirming your legitimate emails are passing, you can switch to "reject".
Step 4: Verify Everything Works
Once all three records are live, test them. Use a tool like MXToolbox or Google's DMARC alignment checker to verify your SPF, DKIM, and DMARC records are correct. Both are free and take 60 seconds.
Then send a test email from your sending service to a Gmail account and check the email headers. Gmail shows you whether SPF, DKIM, and DMARC passed or failed. If they all show "passed" or "signed", you're good.
If something failed, go back and check:
- Did you copy the values exactly from your sending service?
- Is the record name correct (@ for SPF, _domainkey for DKIM, _dmarc for DMARC)?
- Did you wait long enough for propagation? (Try 30 minutes minimum, sometimes up to an hour.)
- Are you using a subdomain? If so, you might need to set up records on the subdomain instead of the main domain.
Common Cloudflare DNS Mistakes That Kill Deliverability
Using "@" for subdomains: If you're sending from [email protected] but want to use send.yourdomain.com as your sending domain, put the records on "send", not "@".
Forgetting to remove old records: If you switch sending services and leave old DKIM records in Cloudflare, email servers get confused. Delete the old ones.
SPF includes with wrong syntax: It's "include:" not "a:" or "mx:". Check the syntax exactly from your sending service's documentation.
DMARC on the wrong subdomain: _dmarc should always go on the root domain or your sending subdomain, not on a random subdomain.
These DNS records are the foundation of cold email deliverability. Without them correct, even the best email copy and list will struggle to land in inboxes. With them correct, you've eliminated a major source of deliverability problems before you even hit send.