Cloudflare domain email without the guesswork: what Email Routing does and doesn't do, how to connect JustEmails in one click or add each record by hand, and the lock that stalls setups.
Your domain lives on Cloudflare. Maybe you bought it through Cloudflare Registrar, maybe you just pointed its nameservers there. Either way, you now want Cloudflare domain email that does more than forward: an address like hello@yourdomain.com that you can actually send from.
Good news first. Of all the places a domain's DNS can sit, Cloudflare is the easiest for us: our dashboard connects to it and adds the records for you in one click. We'll take that.
For the background on what MX, SPF, DKIM and DMARC actually do, see our custom domain email setup guide. This page sticks to Cloudflare's screens and Cloudflare's quirks.
Cloudflare doesn't sell mailboxes the way GoDaddy or Namecheap do. What it offers is called Cloudflare Email Service, and it has two parts (as described in Cloudflare's Email Service docs on 8 October 2026):
Those docs describe no hosted inbox: no IMAP, no webmail, nowhere to log in and read mail. Cloudflare's guide to setting up email records says as much, indirectly. As of 8 October 2026 it reads: "If you only need to receive emails, Cloudflare offers Email Routing for free email forwarding to custom email addresses." To send and receive, it adds, "you need an SMTP provider".
Keep Email Routing if all you want is mail to hello@yourdomain.com landing in an inbox you already check, and you never need to reply from that address. It's free (as of 8 October 2026), and it works. Don't pay anyone for that, us included.
Use a separate email host if you want to send as your domain from a normal mail app, have more than one real mailbox, or run email for several domains from one place.
JustEmails is $49 a year, one flat price for unlimited domains and mailboxes, with 10 GB of storage included and more available if you outgrow it. Our breakdown of what a custom domain email address really costs puts the main options side by side, and our comparison of Cloudflare Email Routing and JustEmails goes deeper on forwarding versus real mailboxes.
One thing you can't do is both at once. The troubleshooting notes in Cloudflare's Email Service domain docs are blunt about it: "Email Routing requires Cloudflare MX records. Remove or update existing MX records. Cannot use Email Routing with external mail servers." Pick one for incoming mail.
1. Does Cloudflare actually run the domain's DNS? Open the domain in the Cloudflare dashboard. If it shows a DNS Records page full of your records, you're set. If the domain is registered somewhere else and its nameservers point elsewhere, the records belong at that provider instead.
2. Is Email Routing turned on? Go to Compute > Email Service > Email Routing and look for the domain. If Routing is on, the MX, SPF and DKIM records it manages carry a Locked status, and Cloudflare says they can't be edited or deleted from DNS > Records until they're unlocked. Skip this check and you'll be left wondering why the Edit button won't cooperate. The section on leaving Email Routing below covers the unlock.
(Older guides send you to "Email > Email Routing". Cloudflare has since moved it under Compute > Email Service, and its old email-routing doc URLs now redirect.)
3. Have you added the domain in JustEmails? Three of the values below are unique to your domain: the DKIM key, the verification token and the MTA-STS id. Our dashboard generates them once the domain is added.
This is the route we'd pick.
Two things to know before you click. The connect removes any MX records that aren't ours, so incoming mail moves to us at that moment, and it folds our SPF entry into an existing SPF record rather than adding a second. What it won't touch is an existing DMARC record; more on that under the table.
Once it's done, open the domain's DNS Records page in Cloudflare and look at the mta-sts CNAME. Its Proxy status should read DNS only (the gray cloud, not the orange one). If it's orange, select Edit, switch it to DNS only, and Save. More on why under the problems section.
If the dashboard flags anything as missing after connecting, add that record by hand using the table and steps below. Same values, same place.
This is what our setup screen asks for, in the order you'd add them by hand:
| Type | Name / host | Value | What it does |
|---|---|---|---|
| MX | @ (the domain) | mail1.justemails.app priority 10 | Delivers incoming mail to us |
| TXT | @ | v=spf1 a:mail1.justemails.app ~all | SPF: lets us send for the domain |
| TXT | dkim._domainkey | v=DKIM1; k=rsa; p=… (unique per domain) | DKIM signature key |
| TXT | arc._domainkey | v=DKIM1; k=rsa; p=… (same key as DKIM) | Signs forwarded mail |
| TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@justemails.app | DMARC policy |
| TXT | @ | justemails-verify=… (from the dashboard) | Proves the domain is yours |
| TXT | _mta-sts | v=STSv1; id=… (from the dashboard) | Turns on enforced encryption |
| CNAME | mta-sts | mta-sts.justemails.app | Hosts the encryption policy |
Copy the p=… key, the verification token and the id=… value from your dashboard, never from a guide (this one included).
One SPF record only. If the domain already has a TXT record on
@startingv=spf1, edit it rather than adding a second. With two SPF records, both stop working. On Cloudflare the usual culprit is Email Routing'sv=spf1 include:_spf.mx.cloudflare.net ~all.
Only one DMARC record, too. If a
_dmarcTXT already exists (some registrars and email products add one), edit it to our value instead of adding a second. The one-click connect leaves an existing DMARC record alone, so check this one yourself.
Every step and field name below comes from Cloudflare's current developer docs.
In the Cloudflare dashboard, select the domain and go to its DNS Records page.
If Email Routing is on, deal with it first (next section). If there are MX records from some other old email service, delete them: on the record select Edit, then Delete, then Delete again to confirm. Screenshot them before you do, just in case.
Select Add record and set Type to MX, then fill in the four fields that matter: Name @, Mail server mail1.justemails.app, TTL Auto, Priority 10. Select Save. One MX record is all you need; don't add a backup.
Found an existing v=spf1 TXT on @? Select Edit on it, replace the value with v=spf1 a:mail1.justemails.app ~all, and Save. No existing one? Add a TXT record with Name @ and that value. If another service also sends mail as your domain, its part goes into this same record, never a second one.
Select Add record, choose TXT, fill in the name and the value, leave TTL on Auto, Save. Repeat for:
dkim._domainkey with your DKIM valuearc._domainkey with the same key_dmarc with the DMARC value@ with your justemails-verify=… token_mta-sts with your v=STSv1; id=… valueThe Name field takes just the label. Cloudflare uses @ for the root of the domain and the bare label for everything else, so type _dmarc, not _dmarc.yourdomain.com. You'll notice TXT records have no orange cloud. That's normal: Cloudflare says MX and TXT records are always DNS-only.
Choose CNAME, set the name to mta-sts and point it at mta-sts.justemails.app. Before saving, check Proxy status and set it to DNS only. Then Save.
If Routing is already forwarding your mail, order matters. Cloudflare's domain configuration page warns that disabling Routing "removes every routing-related DNS record (MX, SPF, DKIM) that Email Service added to the root domain. If you plan to switch to a different email provider, unlock the records and add the new provider's records before disabling Email Routing so that mail flow is not interrupted."
So, in Cloudflare's order:
cf-bounce records stay locked for as long as Sending is set up, which doesn't matter here: none of our records live on that subdomain.v=spf1 include:_spf.mx.cloudflare.net a:mail1.justemails.app ~all, then drop the include once Routing is disabled.cf2024-1._domainkey.v=spf1 a:mail1.justemails.app ~all. If either vanished, add it again.Our dashboard checks each record and shows which are still missing. DNS changes usually show up within minutes and can take a few hours. On Cloudflare DNS you'll normally be at the quick end, since Cloudflare says changes there usually complete within 5-15 minutes.
Prefer a terminal? Cloudflare's troubleshooting suggests these two:
dig MX yourdomain.com
dig TXT yourdomain.com | grep spf
You want to see mail1.justemails.app in the first and exactly one v=spf1 line in the second. One, not two.
Once everything's verified, we keep watching. If your SPF, DKIM, DMARC or MX record changes or disappears later, we detect it and email you. Worth having on a platform where turning on another email feature can quietly add records of its own.
One thing to plan for: a newly verified domain is limited to no more than 50 emails a day in its first week, 200 a day in its second, and up to 500 a day from day 15, counted from the day the domain verified. Mail-app settings are in the general setup guide.
Locked records. The Edit button does nothing useful on Routing's MX, SPF and DKIM records until you unlock them (step 1 of leaving Email Routing, above).
Two SPF records. A domain with Email Routing on has v=spf1 include:_spf.mx.cloudflare.net ~all on @. Add ours next to it and both fail. Cloudflare's troubleshooting list says the same: merge existing SPF records, remove duplicate v=spf1 entries, and make sure only one SPF record exists.
The orange cloud on mta-sts. It's the only one of our records Cloudflare can proxy, and it shouldn't be. It's the one Cloudflare default that works against you here, and easy to miss. Cloudflare's proxy status guidance is that records not serving your own website, "such as CNAME records that prove your domain ownership, should not be proxied". Set it to DNS only.
Two DMARC records. If you also use Cloudflare's Email Sending, it creates its own DMARC record at _dmarc when you set the domain up for sending. A domain should have one DMARC record, so check _dmarc before adding ours.
An extra address in your DMARC record. Turned on Cloudflare's DMARC Management? Then Cloudflare adds its own rua reporting address to your existing DMARC record. Seeing a second rua next to ours is expected, not an error.
Mail still going to the old forwarding address. Routing's MX records are still in place. Disable Routing once our records are verified.
Not a mailbox you can log in to. Cloudflare Email Service has two parts: Email Routing, which forwards incoming mail to an address you already have or hands it to a Worker, and Email Sending, a beta for outbound transactional mail from code. Neither gives you IMAP, webmail or an inbox. Email hosting for a Cloudflare domain means keeping DNS at Cloudflare and pointing the domain's mail records at a separate host, which is what the records in this guide do.
No. Email Routing only handles incoming mail: it forwards messages for hello@yourdomain.com to an inbox you already have, and any reply goes out from that other address rather than from your domain. Cloudflare's DNS documentation is clear that two-way email from your domain needs an SMTP provider. To send as your domain from Outlook, Apple Mail or your phone, add a separate email host and put its MX, SPF and DKIM records on the domain.
Not for incoming mail. Cloudflare states that Email Routing requires Cloudflare MX records and cannot be used with external mail servers, so one of the two has to own the domain's MX. If Routing handles your mail today, switch in this order: unlock its records, add ours next to them, let our dashboard verify every one, and only then disable Routing. Mail keeps arriving the whole time.
Because Email Routing is on and manages those records. They show a Locked status in the dashboard and can't be edited or deleted from DNS > Records until you unlock them. The Unlock option sits under Compute > Email Service > Email Routing, in the domain's Settings, next to each record. Only those root-domain routing records can be unlocked; if Email Sending is on, its records on the cf-bounce subdomain stay locked, and everything else on the domain edits as normal.
No. Switch its Proxy status to DNS only, the gray cloud. Of everything we ask you to add, it's the one record Cloudflare could proxy, and Cloudflare advises against proxying records that don't serve your website, such as CNAMEs that prove you own the domain. MX and TXT records can't be proxied at all, which makes this CNAME the single record worth checking after a one-click connect.
Usually minutes. Cloudflare's figure for domains on its DNS is 5-15 minutes in most cases, but give it a few hours before deciding something is stuck. Our dashboard marks each record as found or missing, so you can see when the domain is ready instead of guessing. If a record is still missing after that, look for two v=spf1 records on @, or for Email Routing's records still in place.
For Cloudflare domain email, the whole job is three steps: add your domain, hand the dashboard a Cloudflare token at the DNS step, and let it add the records and tell you when they're all in. If you'll also send from your app, our transactional API is part of the paid plan, and what it sends counts against the same daily limit as mail from your mailboxes. It's $49 a year for every domain and every mailbox on the account. Details are on our pricing page.