How to configure Hosted DMARC CNAME on Cloudflare (DNS-only proxy mode)

22 October 2026

Hosted DMARC needs one customer record: a CNAME at _dmarc. On Cloudflare that CNAME must be DNS only (grey cloud). An orange-cloud proxy answers HTTP for that hostname and will not hand receivers a usable DMARC TXT through the CNAME chain.

Why the orange cloud breaks DMARC

Proxy mode is for web traffic. Mail receivers look up _dmarc.brand.example expecting either a TXT or a CNAME that leads to a TXT. Cloudflare’s HTTP proxy does not publish that TXT for them. Sender Identity’s account panel warns about the same detail: keep Hosted DMARC CNAMEs DNS-only.

Steps

Open Account on Sender Identity, add the domain, and copy the Hosted DMARC CNAME target (shape brand.example._dmarc.hosted.senderidentity.com).
In Cloudflare → DNS → Records, delete any TXT at _dmarc (two records at that name will break DMARC).
Add CNAME, name _dmarc, target the hosted name from Account.
Set Proxy status to DNS only. The cloud icon must be grey—not orange.
Save. Wait for TTL, then run the free static audit and confirm Account shows delegation ready.

Type	Name / host	Value / points to	Note
`CNAME`	`_dmarc.brand.example`	`brand.example._dmarc.hosted.senderidentity.com`	DNS only on Cloudflare. Remove any TXT at the same name.

What stays on your zone

Apex SPF, MX, and website records are untouched.
We publish the DMARC TXT on the hosted name, starting at p=none with rua at reports.senderidentity.com.
Quarantine and reject stages move only when a person approves them in Account—not on a calendar alone.