VerifySeal ManagerLive verification platform
← All installation guides Email authentication and DNS

Set up Cloudflare Email DNS for an Email Sender Seal

Publish the SPF, DKIM and DMARC records supplied by your email service in a Cloudflare-managed DNS zone.

CF✉
Recommended methodEmail DNS and seal setup
Email authentication setup

Configure email DNS and find the selector

  1. 1

    Get records from the sending service

    Cloudflare hosts DNS but does not choose the signing selector for another mail service. Copy the exact SPF, DKIM and DMARC names, record types and values from the service that sends the email.

  2. 2

    Open the authoritative zone

    In Cloudflare select the correct website, open DNS and Records, then choose Add record. Confirm the domain nameservers actually point to Cloudflare before editing.

  3. 3

    Add DKIM exactly as supplied

    Choose TXT or CNAME as specified by the email provider. Enter the complete selector host, such as google._domainkey, and keep DKIM CNAME records DNS-only if a proxy option is shown.

  4. 4

    Add SPF and DMARC

    Maintain one SPF TXT record at the root and one DMARC TXT record at _dmarc. Do not overwrite existing authorized sending services without reviewing them.

  5. 5

    Confirm the selector and validate

    Send an external test message, find the DKIM-Signature with the matching d= domain, copy its s= selector into VerifySeal and run the email DNS check.

Open Cloudflare DNS record documentation ↗
Email Sender Verification Seal

Complete authentication before installing the seal

The sender domain must continue to publish a valid SPF record, the selected DKIM key and a DMARC policy. VerifySeal automatically rechecks these records according to the administrator schedule. For High Security messages, DKIM must cover the final Message-ID, VEM header and completed body.

  • SPF authorizes sending services
  • DKIM verifies the signed message domain
  • DMARC publishes the domain policy
Testing checklist

Confirm the installation is working

01

SPF

The sender domain has one valid SPF record containing every authorized sending service.

02

DKIM

A new external message reports DKIM pass and its matching signature contains the selector entered in VerifySeal.

03

DMARC

A DMARC record is published at _dmarc and its policy matches the organization’s approved rollout.

04

VerifySeal

The customer order reports SPF, DKIM and DMARC as verified before the Email Sender Seal is issued.

Platform notes
  • Changing records in Cloudflare has no effect if the domain is delegated to different nameservers.
All seal types

View every available VerifySeal design

Domain OwnershipEmail Sender VerificationHigh Security Email VerificationVerified BusinessVerified OrganizationVerified ResellerTrusted WebsiteCertified MemberAustralian Builder LicenceAustralian Financial Services LicenceWebsite PCI DSS ComplianceDocument IntegrityVerified Issuer DocumentHigh Security Document Authentication