Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter tools…

Authentication
Deliverability
Monitoring
- Google Postmaster Tools
- Microsoft SNDS
Email Validation
DNS
Inbox Placement
- Inbox Monster
Testing
- Mail-Tester
- GlockApps
Analytics
- Google Analytics 4
Infrastructure
- Cloudflare DNS
Automation
- Customer.io
ESPs
Development
- Swaks
Utilities
- WHOIS / RDAP

Home
Tools
Infrastructure
Cloudflare DNS

Cloudflare DNS

Authoritative DNS hosting commonly used to publish SPF, DKIM, DMARC, and MX records.

Reading time:: 5 min
Difficulty:: Beginner
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Overview

Authoritative DNS hosting commonly used to publish SPF, DKIM, DMARC, and MX records.

Vendor: Cloudflare

Primary purpose

Host and edit authoritative DNS for mail authentication and routing.

Best for

Teams publishing and iterating mail DNS records quickly

Common use cases

Publish SPF/DKIM/DMARC
Lower TTL for cutovers

Advantages

Fast UI/API
Global DNS footprint

Limitations

DNS hosting ≠ deliverability monitoring

When not to use it

Corporate DNS must stay on an internal enterprise platform

Pricing

Free DNS tier with paid platform plans.

Official website

www.cloudflare.com/dns/

Inputs and outputs

Typical inputs

DNS records

Typical outputs

Authoritative answers

Privacy notes

Review each vendor’s data handling before uploading production lists or message content.

Related learning

DNSDomain Name System — the lookup fabric email authentication depends on.

Related problems

CNAME at zone apexA CNAME is placed at the zone apex where other record types are also required.
HELO / EHLO problemsThe SMTP HELO/EHLO hostname is missing, invalid, or inconsistent with reverse DNS.
Inconsistent authoritative answersAuthoritative name servers for the same zone return conflicting data.
Incorrect MX targetMX points to the wrong host name or unreachable mail server.
Missing glue recordsDelegation references in-bailiwick name servers without required glue.
MX record missingNo MX record is published for a domain that should receive mail.
NXDOMAIN for expected nameA name that should exist returns NXDOMAIN from authoritative servers.
Reverse DNS mismatchPTR (reverse DNS) for a sending IP is missing or does not match the forward hostname used in mail.
Stale DNS cache after changeResolvers still serve prior answers after an authoritative change because TTL has not expired.
Wrong TTL for cutoverTTL values are too high for a planned cutover, prolonging mixed old/new answers.

Related tools

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
nslookupInteractive DNS lookup utility commonly used for quick MX and TXT checks.
Google Admin Toolbox DigBrowser-based dig-style DNS lookup from Google’s Admin Toolbox.
Google Admin Toolbox CheckMXGoogle Admin Toolbox Check MX for inbound mail DNS sanity checks.

Workflows

Open step-by-step: Configure SPFPublish and validate an SPF policy for authorized senders.
Open step-by-step: Verify DNS recordsVerify zone authority, MX/address records, and authentication-related TXT publications.

Continue Learning

Open step-by-step: Configure SPFPublish and validate an SPF policy for authorized senders.

PreviousInfrastructure

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.