---
title: "Add a DKIM record at Cloudflare, plus SPF and DMARC"
date: "2026-11-06"
author: RocketCart
url: "https://getrocketcart.com/docs/sending-domain/cloudflare/"
type: docs
---

To send RocketCart emails from a domain on Cloudflare, add three TXT records under **DNS > Records** in the Cloudflare dashboard. Cloudflare takes the long DKIM value without problems, and TXT records are never proxied, so there is no orange cloud to worry about.

## The records RocketCart needs

| Record | Type | Name | Value |
| --- | --- | --- | --- |
| SPF | TXT | `@` | `v=spf1 include:mailgun.org ~all` |
| DKIM | TXT | `<selector>._domainkey` | `v=DKIM1; k=rsa; p=<your public key>` |
| DMARC | TXT | `_dmarc` | `v=DMARC1; p=none` |

- Copy every value from the **DNS records** panel in RocketCart (**Settings > Email Settings**). Click **Copy value** on each tab. `<selector>` and `<your public key>` are unique to your store. If the app shows the literal word `<selector>` in Host/Name, your selector is your store name as RocketCart saved it on install: lowercase letters and numbers, hyphens between words, for example `my-store` for “My Store”.
- Cloudflare adds your domain to the name. Type `@` for the domain itself, and only the prefix for the others.

## How do I add a TXT record in Cloudflare?

1. Log in to the Cloudflare dashboard and select your account and domain.
2. Go to **DNS > Records**.
3. Click **Add record**.
4. Under **Type**, choose **TXT**.
5. In **Name**, enter the name from the table, for example `_dmarc`.
6. Leave **TTL** on **Auto**.
7. In **Content**, paste the value you copied from RocketCart.
8. Click **Save**.
9. Repeat for the other two records.

Note

Cloudflare’s proxy (the orange cloud) only applies to A, AAAA and CNAME records. Cloudflare says other record types, such as TXT, are always DNS only. RocketCart needs no CNAME records, so you have nothing to switch off.

Warning

Records only work where your domain’s DNS is managed. If your domain’s nameservers point to another company (for example your web host), add the records there instead. Cloudflare only answers for your domain if the nameservers at your registrar point to Cloudflare.

## What if I already have an SPF record?

A domain can only have one SPF record. With two, both fail. If you already have a TXT record that starts with `v=spf1`, edit that one instead of adding a new one. Put `include:mailgun.org` **before** the `~all` or `-all` at the end:

|  | Value |
| --- | --- |
| Your record now | `v=spf1 include:_spf.google.com ~all` |
| After your edit | `v=spf1 include:_spf.google.com include:mailgun.org ~all` |

Keep every service your record already lists. Only add `include:mailgun.org`.

Mail servers stop reading an SPF record at `~all` or `-all`, so an include placed after it is ignored. If the value RocketCart suggests ends with `include:mailgun.org`, move that part in front of `~all` when you paste it.

## What if I already have a DMARC record?

Keep it and skip the DMARC record. A domain should have only one DMARC record on `_dmarc`, and RocketCart accepts any valid one.

## Verify the records in RocketCart

1. In RocketCart, go to **Settings > Email Settings**.
2. In the **DNS records** panel, click **Verify DNS**.
3. When all three tabs show **Verified** (**Status: 3/3 DNS records verified.**), turn on **Enable custom domain**.

DNS changes can take up to 24 hours. RocketCart only checks when you click **Verify DNS**, so click it again later if a record still shows **Missing**. The full flow is in [Set up a custom sending domain](/docs/sending-domain/set-up-sending-domain/). If a record won’t verify, see [Sending domain not verifying](/docs/troubleshooting/sending-domain-not-verifying/).