Fix Email Problems After Enabling Cloudflare

If your email stops working after you enable Cloudflare, the cause is almost always a DNS record change or an IP address mismatch—not a problem with your mail server itself. This guide walks you through the most common culprits and the exact steps to diagnose and fix them, so you can restore mail delivery quickly.

Why Cloudflare Breaks Email

Cloudflare sits between your domain and the internet, acting as a reverse proxy for web traffic. When you enable Cloudflare on a domain, it changes the DNS records to point to Cloudflare’s IP addresses. This is fine for HTTP/HTTPS traffic, but email servers (SMTP, IMAP, POP3) do not go through Cloudflare’s proxy. They need to connect directly to your mail server’s real IP address. If your DNS records for mail are accidentally proxied (orange cloud) or point to the wrong IP, email delivery fails.

Common Symptoms and Their Causes

Outgoing mail rejected: Your mail server’s IP is hidden behind Cloudflare, so receiving servers see Cloudflare’s IP and may reject the connection as spam or fail the SPF check.
Incoming mail not arriving: The MX record points to a hostname that resolves to Cloudflare’s proxy IP, so external servers can’t reach your actual mail server.
Can’t connect to IMAP/POP3: Your mail client tries to connect to a hostname that resolves to Cloudflare’s proxy, which doesn’t forward mail ports (993, 995, 587, 25) properly.
Email authentication failures: SPF, DKIM, and DMARC checks fail because the sending IP doesn’t match the domain’s SPF record, or because DKIM signatures are stripped by the proxy.

Step-by-Step Diagnosis

Check your DNS records in Cloudflare: Go to the Cloudflare dashboard for your domain, click DNS, and look for any records with a hostname that starts with mail, smtp, imap, or pop. Also check the MX record (it usually points to mail.yourdomain.com or a provider like mx1.example.com).
Look for the orange cloud icon: If any mail-related A/AAAA or CNAME record has the orange cloud (proxied), click it and change it to DNS only (gray cloud). This is the most common fix.
Verify the IP addresses: For the A record of mail.yourdomain.com, make sure it points to your mail server’s actual public IP address, not a Cloudflare IP. You can find your mail server’s IP from your hosting provider or by checking your mail server’s settings.
Check your MX record: The MX record should point to a hostname that resolves directly to your mail server (e.g., mail.yourdomain.com). If it points to a hostname that is proxied, fix that hostname’s A record to be DNS only.
Test with dig or an online tool: Run dig MX yourdomain.com and dig A mail.yourdomain.com to see what IPs are returned. If the A record returns a Cloudflare IP (104.x.x.x, 172.67.x.x, etc.), that’s the problem.

Fixing the DNS Records

Once you’ve identified the problematic records, here’s how to correct them:

Set mail records to DNS only: In Cloudflare, click the orange cloud on the mail record and select DNS only. This tells Cloudflare to only resolve the domain name, not proxy the traffic.
Update the A record for mail: If your mail server’s IP has changed, update the A record to the correct IP. If you’re using a third-party mail service (like Google Workspace or Microsoft 365), you’ll need to follow their specific DNS instructions—usually they provide a CNAME or MX record to use.
Add SPF, DKIM, and DMARC records: If they’re missing, add them. For SPF, a typical record is v=spf1 ip4:YOUR_MAIL_SERVER_IP -all. For DKIM, you’ll need the public key from your mail provider. DMARC is usually v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.com.

Email Authentication (SPF, DKIM, DMARC)

Even if your mail flows, it might land in spam because authentication fails. Cloudflare doesn’t modify email headers, but if your domain’s DNS is misconfigured, receiving servers can’t verify your mail.

SPF: This record lists which IPs are allowed to send mail for your domain. If your mail server’s IP isn’t listed, receiving servers may reject or spam-folder your mail. Make sure your SPF record includes the actual sending IP.
DKIM: This uses a digital signature to verify the email hasn’t been tampered with. The public key is published in a DNS TXT record. If you use a third-party mail service, they’ll provide the exact record to add.
DMARC: This tells receiving servers what to do if SPF or DKIM fails. It’s a TXT record at _dmarc.yourdomain.com. Start with p=none to monitor, then tighten later.

Advanced: When You Use a Third-Party Mail Service

If you use Gmail, Outlook, or another provider for email, you don’t host your own mail server. In that case, you need to point your MX records to the provider’s servers, and you usually don’t need an A record for mail at all. The provider will give you a list of DNS records to add—these are always DNS-only, never proxied. For example, for Google Workspace, you’d add MX records like aspmx.l.google.com (which are CNAMEs, not A records). Make sure those are gray-clouded.

Frequently Asked Questions

Why does Cloudflare proxy my mail records by default?

When you add a domain to Cloudflare, it scans existing DNS records and may automatically proxy any A/AAAA records it finds, including mail. This is because Cloudflare assumes all traffic is web traffic. You need to manually switch mail records to DNS only.

Can I use Cloudflare’s email routing feature?

Cloudflare offers Email Routing, which forwards emails sent to your domain to a personal email address. This is separate from your mail server. If you enable it, Cloudflare adds MX records that point to its own servers—these are fine to proxy, but they only handle incoming mail for forwarding, not outgoing mail.

How do I find my mail server’s real IP?

Check your hosting control panel (cPanel, Plesk, etc.) or ask your hosting provider. You can also look at the welcome email from your host. If you’re self-hosting, check your server’s network configuration.

What if I have an A record for `mail` but I don’t use a mail server?

If you don’t use email at all, you can safely delete the A record for mail. But if you use a third-party service, the provider will give you specific MX records to use instead.

Why do my emails still go to spam after fixing DNS?

DNS is just one factor. Check your IP’s reputation, ensure your reverse DNS (PTR record) matches your sending hostname, and verify that your SPF, DKIM, and DMARC are correctly configured. Also, warm up your IP if you’re sending from a new server.

Does Cloudflare’s free plan include email support?

Cloudflare’s free plan doesn’t include email hosting or SMTP relay. It only provides DNS and CDN services. For email, you need a separate email hosting provider or your own mail server.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →