Start free
Menu
In this section

Troubleshooting

Publishing through Cloudflare fails

On every plan

When Publish record fails, the domain's Records tab says why in one sentence. Cloudflare's own message follows it, after "Cloudflare says". Most failures come from the token: Cloudflare no longer accepts it, it may not edit the zone, or the zone is in another Cloudflare account. For those, create a token that fits and connect it in place of the old one. Find the sentence you see below.

Cloudflare does not accept the stored token any more

The page says: "Cloudflare does not accept the stored token any more. Connect it again." While you connect a token, the same problem reads "Cloudflare does not accept this token. Check that you copied all of it."

Cloudflare refuses the token itself. It may have been deleted or rolled in Cloudflare, or it has expired. While you connect, part of it may have been lost in copying. When you connect a token that Cloudflare does not list as active, the message after "Cloudflare says" gives its status, such as expired.

Create a new token and connect it.

The stored token cannot edit DNS in this zone

The page says: "The stored token cannot edit DNS in this zone. It needs Zone / DNS / Edit." While you connect, it reads "This token cannot edit DNS in that zone. It needs Zone / DNS / Edit."

Cloudflare accepts the token, but the token may not change DNS records in your domain's zone. It may only read, or it may be limited to other zones.

In Cloudflare, give the token Zone / DNS / Edit for the zone, or create a new one from the template Edit zone DNS. Then connect it again.

The zone is not in the account the token belongs to

The page says: "The zone is not in the account the token belongs to."

When you connect a token, we note the zones it reaches and publish into the one that holds your domain. We or Cloudflare answer this way when that zone is no longer there for the token. The zone may have moved to another Cloudflare account. Or it was deleted and added again, which gives it a new identity in Cloudflare.

Create the token in the Cloudflare account that holds the zone now, and connect it. Connecting reads the token's zones again.

Cloudflare is asking us to slow down

The page says: "Cloudflare is asking us to slow down. Try again in a minute."

Cloudflare limits how often its API may be called. Nothing is wrong with your token or your zone. Wait a minute, then press Publish record again.

We could not reach Cloudflare

The page says that we could not reach Cloudflare, and to try again shortly.

The connection to Cloudflare's API failed, or Cloudflare did not answer in time. If the text after "Cloudflare says" is a technical name such as URLError, it is our note that Cloudflare could not be reached, not a message from Cloudflare. Nothing is wrong with your token. Try again in a few minutes.

Cloudflare returned an error we did not expect

The page says: "Cloudflare returned an error we did not expect."

Cloudflare refused the write for a reason that is none of the above. Its own message, after "Cloudflare says", names what it objected to.

One cause is a CNAME record at the same name, _dmarc or _smtp._tls under your domain, for example when another DMARC service manages the record. A name that holds a CNAME cannot hold any other record, so Cloudflare refuses the TXT record. Delete the CNAME in Cloudflare and press Publish record again, or publish the record by hand.

Publishing replaces the TXT record at that name, and deletes any other TXT records there. If you have an old DMARC record, read what publishing replaces before you press Publish record.

If you cannot act on Cloudflare's message, copy the record into Cloudflare by hand: the Records tab shows its name and value. Then write to support with Cloudflare's message, so we can look at it.

There is no Publish record button

  • You are not an admin. Only an admin of the organization sees the button and can connect Cloudflare.
  • Cloudflare is not connected. The page offers a link to connect it.
  • The page says the connected Cloudflare account does not include your domain. We read the token's zones when you connect it. If the zone was added to Cloudflare, or to the token, after that, connect the token again. If the zone is in another Cloudflare account, connect a token from that account.
  • The Cloudflare settings page says the token reaches no zones. Give the token Zone / DNS / Edit on your zone in Cloudflare, then connect it again.

We publish the DMARC and TLS-RPT records only. The verification record has no button.

Cloudflare accepted the record, but DNS has not caught up

This is not an error. The record is written, but DNS does not show it yet. We asked your domain's own name servers once, straight after writing it, and they did not show it then. Wait a minute, then press Check again, which asks them again.

Connect a new token

  1. In Cloudflare, create a token from the template Edit zone DNS, for your domain's zone. Create the token in Cloudflare has the steps.
  2. Open Settings, Cloudflare.
  3. Under Replace the token, paste the new token and press Connect.
  4. Check that the page lists your domain's zone. Then press Publish record on the domain's Records tab again.

Connecting replaces the stored token. Records already published stay as they are.

The last failed write

Until a write succeeds, or until you connect again, the Cloudflare settings page shows the last write that failed. It starts with our short name for the error, then Cloudflare's message. The names match the sections above: invalid_token, not_permitted, zone_not_found, rate_limited, unreachable and api_error.

Published 27 October 2026 · Checked 27 October 2026