Cloudflare proxied (orange cloud) records break email: how to fix

What it means

In Cloudflare DNS, each A, AAAA and CNAME record has a Proxy status: Proxied (orange cloud) or DNS only (grey cloud). When a record is proxied, Cloudflare does not publish your server's real IP. It answers with Cloudflare's own IPs and passes web traffic (HTTP/HTTPS) to your server.

Email does not go through that proxy. So if a record used for email is proxied, other servers get Cloudflare's address instead of your mail server's. The symptoms:

• Nobody can send email to you: the MX points to a host that resolves to Cloudflare, and the connection on port 25 fails or times out.
• SPF fails: an a or mx mechanism now resolves to Cloudflare IPs, not your server.
• DKIM or domain verification fails at SendGrid, Mailgun and similar tools: their CNAME records were added as proxied.
• Your mail apps cannot connect to mail.yourdomain.com for IMAP or SMTP.

Why it happens

• Moving DNS to Cloudflare: during the import, Cloudflare may set records to proxied, including mail.
• One A record for both: the website and the mail server share a host name, and someone proxied it for the website.
• Email provider CNAMEs proxied: CNAMEs like em1234.yourdomain.com or s1._domainkey.yourdomain.com added with the orange cloud on.

MX and TXT records cannot be proxied themselves; the problem is always the A, AAAA or CNAME they rely on.

How to check

1. Open the domain scanner and look at your MX records and the IP each MX host resolves to. Use Whois on that IP: if it belongs to Cloudflare and you do not use a Cloudflare mail product for that host, the record is proxied.
2. With dig:

   dig MX yourdomain.com +short
   10 mail.yourdomain.com.
   dig A mail.yourdomain.com +short
   104.16.x.x        (Cloudflare range: wrong for a mail server)

3. Test a DKIM CNAME: a proxied CNAME does not return the TXT key behind it.

   dig TXT s1._domainkey.yourdomain.com +short

4. Send a test email from your server to the unique address on the Delivmail home page (/) and read the SPF result. A fail for your own server's IP often comes from a proxied a or mx target.
5. In the Cloudflare dashboard, open your domain, go to DNS > Records and look at the Proxy status column.

How to fix it

1. Set mail records to DNS only

Edit each of these records and switch the Proxy status to DNS only (grey cloud):

• the A/AAAA record of every host used in your MX records (for example mail, mx);
• the hosts your mail apps connect to for IMAP, POP and SMTP;
• every CNAME given by an email provider (DKIM selectors, return-path or bounce domains, link tracking unless the provider says otherwise);
• any host referenced in SPF with a:.

Type   Name       Content          Proxy status
A      @          203.0.113.80     Proxied   (website: OK)
A      mail       203.0.113.25     DNS only  (mail server)
MX     @          mail.yourdomain.com   priority 10
CNAME  s1._domainkey  s1.domainkey.u123.wl.sendgrid.net   DNS only

2. Separate the website and the mail host

Do not point your MX at the same name as your proxied website. Use a dedicated name like mail.yourdomain.com that is DNS only. Note that a DNS-only mail host publishes its IP; if it is the same IP as your website, it reveals your website's real address. Hosting mail on a different IP or with an email provider avoids that.

3. Make SPF independent of proxied names

Prefer ip4:/ip6: or your provider's include: over a and mx in SPF:

v=spf1 ip4:203.0.113.25 include:_spf.google.com ~all

If you use Google Workspace or Microsoft 365, your MX points to their servers and nothing needs proxying changes there; check the DKIM CNAMEs and the SPF record instead. For related issues, see email records lost after moving your DNS.

Check that it is fixed

Proxy changes take effect quickly, but resolvers may cache old answers for the record's TTL (see DNS propagation and TTL). Then run dig A mail.yourdomain.com again: it should return your server's IP. Send a new Delivmail test and confirm SPF and DKIM pass, re-verify the domain in your email tool, and send an email from an outside mailbox to your domain to confirm reception.