When your domain uses Cloudflare DNS but email is hosted on cPanel, the website and mail service must have correctly separated DNS records. The most common mistake is proxying a mail-only hostname or leaving MX records pointing to an old provider.
This guide focuses on the practical decision points for cloudflare dns records for cpanel email setup. The examples are educational and should be adapted to your site, provider, client agreement or application requirements rather than copied without verification.
Cloudflare DNS Records for cPanel Email: Practical Guide
Before you start: gather the right information
Write down the current environment, version numbers or business requirements. For a live website, create a known-good backup and make potentially disruptive changes on staging first. For business documents, confirm the client, scope and acceptance criteria before using a sample.
Step-by-step walkthrough
- In cPanel, identify the current mail exchanger hostname, server IP and recommended authentication records.
- In Cloudflare DNS, point the MX record to the hostname specified by the mail host.
- Make the mail hostname A/AAAA record DNS-only; normal Cloudflare HTTP proxy does not proxy SMTP, IMAP or POP3.
- Publish the SPF TXT record authorized for the actual sending services and avoid multiple independent SPF policies.
- Enable DKIM in cPanel Email Deliverability and copy the exact TXT record value to the authoritative DNS provider.
- Add a considered DMARC record after understanding which systems send mail for the domain.
- Verify inbound and outbound mail using external accounts and inspect headers and DNS results.
Worked example or reference template
Illustrative DNS layout—not actual values
| Type | Name | Purpose |
|---|---|---|
| A | Actual mail server IP, DNS only | |
| MX | @ | Provider-approved mail.example.com |
| TXT | @ | SPF authorization for real senders |
| TXT | selector._domainkey | DKIM supplied by host |
| TXT | _dmarc | DMARC policy and reporting |
Use the exact values supplied by your host; example.com is a reserved example domain.
How to verify the result
Check the output from the perspective of the person who will use it. Test the critical workflow, note what was changed and preserve enough evidence to reverse a failed update. For public-facing sites, repeat the check while logged out and on a mobile browser. For templates, verify totals, wording and payment or ownership terms before sharing.
Common mistakes to avoid
- Do not copy another company’s MX or DKIM value.
- Do not enable Cloudflare Email Routing if a different provider should receive the same domain’s mail without understanding the MX change.
- Do not orange-cloud the mail server hostname.
Related BDKick tutorials
For the next step, see cPanel Node.js App Cannot Restart: Process Limit Troubleshooting, WordPress SMTP Authentication Failed in cPanel: Troubleshooting. These pages are part of the same article batch; publish the linked posts before promoting this page.
Official documentation and references
Frequently asked questions
Can I proxy the mail subdomain?
Not for standard mail protocols through the normal Cloudflare web proxy; use DNS only.
Does Cloudflare supply cPanel MX values?
No. Your email provider determines the MX and authentication details.
Can I have two SPF TXT policies?
No. Consolidate authorized senders into one SPF policy for the same name.
Does DKIM replace SPF?
No. They are different authentication mechanisms and should be configured appropriately.
Final checklist
Confirm the instructions match your specific environment, save a backup or clean document copy, test the main outcome and record any remaining risks. If you are publishing technical guidance, revisit it after major product updates.
Frequently Asked Questions
Can I proxy the mail subdomain?
Not for standard mail protocols through the normal Cloudflare web proxy; use DNS only.
Does Cloudflare supply cPanel MX values?
No. Your email provider determines the MX and authentication details.
Can I have two SPF TXT policies?
No. Consolidate authorized senders into one SPF policy for the same name.
Does DKIM replace SPF?
No. They are different authentication mechanisms and should be configured appropriately.