Publish the records through Cloudflare

On every plan

If your domain's DNS is at Cloudflare, we can write the DMARC and TLS-RPT records for you. Connect a Cloudflare API token once, and the domain's Records tab gets a Publish record button for each record. Cloudflare is the only DNS host we can write to. For any other host, copy the records in by hand. Before you publish, read what publishing replaces.

Before you publish: what it replaces

Publishing leaves exactly one TXT record at the record's name, the one the tab shows. If Cloudflare has other TXT records at _dmarc or _smtp._tls under your domain, we delete them. The line beside each Publish record button says so.

The contents of the DMARC record you already have are kept. The tab builds the new value from that record, with your tags and report addresses, from our last DNS check of the domain. We check a new domain's DNS as soon as you add it. If you changed the record since, press Check now on its DNS tab first, as publish your DMARC record explains. A record whose version or tag list we cannot read is replaced, and the tab says so before you publish.

Create the token in Cloudflare

1. Sign in to Cloudflare and open My Profile, API Tokens.
2. Create a token from the template Edit zone DNS.
3. Limit it to the zone of your domain. The token needs Zone / DNS / Edit for that zone, and nothing more.
4. Copy the token.

Connect it

1. Open Settings, Cloudflare. Only an admin of the organization can open it.
2. Paste the token and connect.
3. The page lists the zones the token can write in. If it lists none, give the token Zone / DNS / Edit on your zone in Cloudflare and connect again.

We store the token encrypted, one per organization. Connecting again replaces it. Disconnecting Cloudflare on the same page deletes the token, and the records we published stay as they are.

Publish the records

1. Open the domain's Records tab.
2. Under DMARC, choose the settings, then press Publish record. The line beside the button names the Cloudflare zone it writes into.
3. Under TLS-RPT, press Publish record too.

Only an admin sees the button. If the connected Cloudflare account does not include the domain, the tab says so, and you copy the records into your DNS host by hand. A subdomain never has the button, even with a record of its own: copy its records in by hand.

We publish the DMARC and TLS-RPT records only, not the separate verification record. You do not need that one: the DMARC record proves the domain is yours.

What the result means

• Published. DNS already answers with the record.
• Cloudflare accepted the record. DNS has not caught up yet. The record is written, but the zone did not show it when we asked. Press Check again in a minute. An admin can press it once a minute.
• An error. The tab says what went wrong. When the token or the zone is the problem, it adds Cloudflare's own message after "Cloudflare says". The table below says what to do.

When publishing fails

The Cloudflare settings page also shows the last failed write until a write succeeds.

Next, verify that the domain is yours. With the DMARC record published, that usually happens by itself.

Published 27 October 2026 · Checked 27 October 2026