How to Set Up DKIM for Cloudflare Email Routing

Understand DKIM configuration when using Cloudflare Email Routing or Cloudflare as your DNS provider.

Quick Answer — The Record You Need

Record Type

CNAME

Host / Name

Depends on your email provider

Value

Depends on your email provider

Cloudflare Email Routing does not require its own DKIM record. Add DKIM records for your actual email sending provider. Cloudflare DNS is where you manage all DKIM records.

Step-by-Step Setup

Understand Cloudflare's role

Cloudflare is typically your DNS provider, not your email sender. DKIM records for your email provider (Google Workspace, Microsoft 365, etc.) are added through Cloudflare's DNS dashboard.

Log in to Cloudflare

Go to dash.cloudflare.com and select your domain.

Navigate to DNS records

Go to DNS > Records.

Add your email provider's DKIM records

Add the DKIM TXT or CNAME records provided by your email service. Cloudflare DNS supports both record types.

# Example for Google Workspace:
google._domainkey  TXT  "v=DKIM1; k=rsa; p=YOUR_KEY"

# Example for Microsoft 365:
selector1._domainkey  CNAME  selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Verify with your email provider

After adding DKIM records in Cloudflare DNS, verify them in your email provider's dashboard.

Common Gotchas

Cloudflare Email Routing does not add its own DKIM signature. DKIM signing comes from your email sending provider.
When adding DKIM CNAME records in Cloudflare, make sure the proxy toggle (orange cloud) is OFF. DNS-only (gray cloud) is required for email records.
If Cloudflare auto-flattens CNAME records, DKIM CNAME records may not resolve correctly. Ensure the proxy is disabled for all _domainkey records.

Verify Your Setup

After adding your DNS records, use our free DKIM checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

Does Cloudflare Email Routing need its own DKIM record?

No. Cloudflare Email Routing forwards email and does not add its own DKIM signature. DKIM signing is handled by your email sending provider.

How do I add DKIM records in Cloudflare DNS?

Go to DNS > Records in your Cloudflare dashboard. Add the TXT or CNAME records provided by your email service. Ensure the proxy is set to DNS-only (gray cloud).

Why must Cloudflare proxy be off for DKIM records?

Email DNS records (MX, TXT for SPF/DKIM, CNAME for DKIM) must resolve directly, not through Cloudflare's HTTP proxy. The orange cloud proxy is only for web traffic.