Email records · Cloudflare · Microsoft 365

How do I add a DMARC record at Cloudflare for Microsoft 365?

Add one TXT record named _dmarc in your Cloudflare DNS records, with the value v=DMARC1; p=none; rua=mailto:[email protected]. Read the reports it brings, then raise it to p=quarantine and then p=reject. At p=none mail servers are asked to take no action, so it is a setting for reading reports, not protection.

Last read , from the sources at the foot of this page.

With our assessment, where your DNS is at Cloudflare, we close forged email with you one click per step, each step on your approval, with a token you supply for that one use.

Check my firm Read the steps
01

What does a DMARC record do?

It tells mail servers what to do with a message that uses your domain but did not come from a service you approved. It also asks them to send you reports on who sends mail in your name.

02

What record do I publish for Microsoft 365?

A TXT record named _dmarc. Start with the first value below. Replace yourfirm.example with your own domain, and use a mailbox someone reads for the reports.

Start: reports only
v=DMARC1; p=none; rua=mailto:[email protected]
Then: suspicious mail to spam
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Then: forged mail refused
v=DMARC1; p=reject; rua=mailto:[email protected]
03

How do I add it at Cloudflare?

  1. Sign in to Cloudflare and select your domain.
  2. Go to the DNS Records page.
  3. Select Add record and choose TXT as the Type.
  4. Type _dmarc in Name. Leave your domain name out: it is added for you.
  5. Paste the record as the record's value. Leave out quotation marks: Cloudflare adds them.
  6. Select Save.

In our words, from Cloudflare: adding a TXT record, read 14 October 2026. If a screen has changed since, follow the host's own page.

04

When do I move past p=none?

When the reports show every service that sends mail for you passing. Before each step, check that your mail, invoicing, booking and newsletter services are in your SPF record or sign their mail with DKIM. A service that is missing will have its mail sent to spam, or refused.

Move to p=quarantine first. Microsoft suggests raising it in steps with pct=10, 25, 50, 75 and then 100. Then move to p=reject, which asks mail servers to refuse a message that fails.

Sources

Where does this come from?

SPF at Cloudflare for Microsoft 365DKIM at Cloudflare for Microsoft 365DMARC at Cloudflare for Google WorkspaceEvery DNS host and record
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy