Cloudflare Email Routing + Cloudflare Free

Free email at your domain with Cloudflare Email Routing

Turn on Cloudflare Email Routing in the Cloudflare dashboard, check the records it adds, and add the rest yourself in Cloudflare.

  • 2 steps
  • 6 DNS records

Before you start

  1. Sign in to the Cloudflare dashboard and have the inbox you want mail sent to ready.
  2. Open DNS at Cloudflare: Sign in to the Cloudflare dashboard and select your domain. Open the DNS Records page.
  3. Turn on Cloudflare Email Routing first (step 1). It adds most records for you; then add the rest below.

Cloudflare Email Routing on Cloudflare: what to know

How long changes take

Cloudflare says changes to your DNS records take effect worldwide within 5 minutes, usually much less. A record you replaced can stay cached until its old TTL runs out.

Source: FAQ (Cloudflare DNS Docs)

DNS records

Rows marked “Added automatically” are created by Cloudflare Email Routing when you turn it on. You only add the others yourself.

MX records Where incoming email goes Added automatically Type MX Name @ Value route1.mx.cloudflare.net Priority set automatically TTL Auto
MX records Where incoming email goes Added automatically Type MX Name @ Value route2.mx.cloudflare.net Priority set automatically TTL Auto
MX records Where incoming email goes Added automatically Type MX Name @ Value route3.mx.cloudflare.net Priority set automatically TTL Auto
SPF record Which servers may send as you Added automatically Type TXT Name @ Value v=spf1 include:_spf.mx.cloudflare.net ~all Priority n/a TTL Auto
DKIM A signature on every message Added automatically Type TXT Name cf2024-1._domainkey Value Added by Cloudflare Email Routing Priority n/a TTL Auto
DMARC record What to do with fakes · recommended Type TXT Name _dmarc Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Priority n/a TTL Auto

Step by step in Cloudflare

Turn on Email Routing

Cloudflare adds the MX, SPF and DKIM records for you and locks them, so you don't type them in. You only choose where your mail goes.

In the Cloudflare dashboard

  1. In the Cloudflare dashboard, go to Compute > Email Service > Email Routing.
  2. Select Onboard Domain, choose your domain, review the DNS records Cloudflare will add, and select Done.
  3. Under Destination Addresses, add the inbox you already use (for example your Gmail address). Open the verification email and select Verify email address.
  4. Open your domain's Routing Rules tab and select Create routing rule. Enter the part before the @ (for example hello) as the Email pattern, set Action to Send to an email, choose your destination and select Save.
  5. Optional: turn on the catch-all rule under Routing Rules so mail to any other address at your domain is forwarded too.

Add the DMARC record (recommended)

DMARC tells receivers what to do with mail that fakes your domain. How DMARC works

Type
TXT
Name
_dmarc
Content
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  • Email Routing's records don't include DMARC, so add this one yourself in DNS > Records.
  • The report address has to receive mail: create a routing rule for it, or turn on the catch-all, so reports are forwarded to you.

In Cloudflare

  1. On the DNS Records page, select Add record.
  2. Choose TXT as the Type.
  3. Fill in Name and Content.
  4. Select Save.

Send email from your domain address (Gmail + Brevo)

Email Routing only receives mail. To also send as you@yourdomain.com from Gmail, connect Gmail to a sending service's SMTP server. Here is how with Brevo's SMTP relay.

In Brevo: authenticate your domain

  1. In Brevo, click the account dropdown and select Settings > Senders, Domains, IPs > Domains. Click Add a domain, enter your domain and click Add domain.
  2. Choose Authenticate the domain automatically and sign in to Cloudflare when asked, or choose Authenticate the domain yourself and add each record Brevo shows in Cloudflare under DNS > Records > Add record.
  3. If Brevo gives you DKIM records of CNAME type, turn off the Proxy status toggle on each one and keep CNAME flattening off. Otherwise DKIM fails.
  4. Keep a single DMARC record. If you already added the DMARC record from this guide, Brevo's automatic setup asks to replace it; to keep yours, authenticate the domain yourself instead.
  5. Click Authenticate this email domain. It can take up to 48 hours to show as authenticated.

In Brevo: get your SMTP login and key

  1. At the bottom left, click Settings > SMTP & API. On the SMTP tab, note your SMTP login.
  2. Click Generate a new SMTP key and store it somewhere safe: afterwards Brevo only shows its last few digits. Use an SMTP key, not an API key.

In Gmail: add your domain address

  1. On your computer, open Gmail, click Settings > See all settings, and open the Accounts and Import (or Accounts) tab.
  2. In Send mail as, click Add another email address. Enter your name and your domain address (for example hello@yourdomain.com) and click Next Step.
  3. Enter smtp-relay.brevo.com as the SMTP server, your Brevo SMTP login as the username and your SMTP key as the password. Choose port 465 with SSL, then click Add Account.
  4. Gmail sends a confirmation message to your domain address, and Email Routing forwards it to your inbox. Open it and click the link.

Check your setup

Once the records are saved, run a live check. We look up your domain in public DNS and tell you what is right, missing or wrong, with the fix in Cloudflare’s words.

We only read public DNS records. Nothing is stored.

Common mistakes with Cloudflare Email Routing on Cloudflare

Leaving another provider's MX records

Onboarding fails with error 2008 while non-Cloudflare MX records exist. Delete them, then onboard right away so the gap without MX records stays short.

Not verifying the destination address

A routing rule that points to an unverified address stays disabled. Open Cloudflare's verification email and select Verify email address.

Cloudflare: Turn off Cloudflare Email Routing first

If Email Routing is on, Cloudflare has added locked MX records (route1, route2 and route3.mx.cloudflare.net) and an SPF record with include:_spf.mx.cloudflare.net. Unlock them or disable Email Routing (Compute > Email Service > Email Routing > your domain > Settings) before switching to another provider. Email Routing can't be used with an outside mail server.

1 more Cloudflare Email Routing mistake to avoid

Visit Cloudflare Email Routing Visit Cloudflare

Cloudflare Email Routing on Cloudflare: questions

How do I move to a paid mailbox later without losing mail?

Unlock the Email Routing records (Email Routing > Settings > DNS records > Unlock), add the new provider’s records alongside them, and disable Email Routing once the new mailbox receives mail. Disabling removes the MX, SPF and DKIM records Email Routing added.

Do I have to add Cloudflare Email Routing DNS records in Cloudflare myself?

Cloudflare adds the MX, SPF and DKIM records for you and locks them, so you don't type them in. You only choose where your mail goes. The one you add yourself: DMARC record. Sign in to the Cloudflare dashboard and select your domain. Open the DNS Records page.

Is Cloudflare Email Routing free?

It's available on Cloudflare's Free plan.

Can I send email from my domain address with Cloudflare Email Routing?

Email Routing only receives mail. To also send as you@yourdomain.com from Gmail, connect Gmail to a sending service's SMTP server. Here is how with Brevo's SMTP relay. Brevo doesn't need an SPF record to authenticate a domain (only for a dedicated IP), so you can leave Email Routing's SPF record as it is. Once your domain is authenticated in Brevo, every sender address on it is verified automatically. Brevo's Free plan includes 300 email sends per day.

Does Cloudflare Email Routing work with other DNS hosts?

No. Email Routing only works when your domain's DNS is managed by Cloudflare.

What goes in the Name field at Cloudflare?

Enter @ for records on your bare domain, such as MX and SPF. For the others, enter only the part before your domain, for example cf2024-1._domainkey. Cloudflare adds your domain automatically.

Do I need to delete my existing MX records at Cloudflare?

Delete any other MX records first. Cloudflare won't turn on Email Routing while other MX records exist (error 2008, Non-Cloudflare MX records exist). If Email Routing is on, Cloudflare has added locked MX records (route1, route2 and route3.mx.cloudflare.net) and an SPF record with include:_spf.mx.cloudflare.net. Unlock them or disable Email Routing (Compute > Email Service > Email Routing > your domain > Settings) before switching to another provider. Email Routing can't be used with an outside mail server.

How long until Cloudflare Email Routing works on Cloudflare?

Cloudflare says changes to your DNS records take effect worldwide within 5 minutes, usually much less. A record you replaced can stay cached until its old TTL runs out.

Sources

Every value and step on this page comes from these official pages. Dashboards change, so if something doesn’t match what you see, tell us.

Cloudflare Email Routing on other hosts

Email Routing only works when your domain's DNS is managed by Cloudflare.

Other email providers on Cloudflare