# Set Up DKIM on Cloudflare

> Step-by-step instructions to add a DKIM TXT record to a domain managed in Cloudflare DNS, so Warmerly can verify your email authentication.

Source: https://warmerly.com/docs/guides/dkim/cloudflare

**DKIM** (short for **DomainKeys Identified Mail**) is a small stamp added to your emails that proves they really came from your domain. If Warmerly told you your DKIM is missing and your domain's **DNS** (Domain Name System, the settings that control where your domain points) is managed in Cloudflare, this guide shows you exactly where to click. For the full explanation of what DKIM is and why it matters, see [What Is DKIM?](https://warmerly.com/docs/guides/dkim).

Before you start, make sure you already have your DKIM **selector** (a short label, like `google` or `s1`) and your DKIM **value** (a long string of letters and numbers). Your email provider (Google Workspace, Microsoft 365, Mailgun, SendGrid, etc.) gives you these two things. If you don't have them yet, go back to [Step 2 of the DKIM guide](https://warmerly.com/docs/guides/dkim#step-2-if-dkim-is-not-found-get-your-dkim-record) first.

## Step 1: Log in to Cloudflare

1. Go to [dash.cloudflare.com](https://dash.cloudflare.com) and log in.
2. On the main dashboard, click the domain (Cloudflare calls it a **site**) that you use to send email, for example, `yourbusiness.com`.

## Step 2: Open the DNS Records tab

1. Once you're inside your site, look at the left-hand menu.
2. Click **DNS**, then click **Records**. This page lists every DNS entry for your domain, things like your website's address and your existing email settings.

## Step 3: Add a new TXT record

A **TXT record** is just a plain-text entry in your DNS. This is the type of record DKIM uses.

1. Click the **Add record** button.
2. For **Type**, choose **TXT** from the dropdown.
3. For **Name**, enter your DKIM selector followed by `._domainkey`. For example, if your selector is `google`, enter `google._domainkey`. Your email provider's instructions will usually show you this full name already. You can copy it directly.
4. For **Content**, paste the long DKIM value your email provider gave you. Paste it exactly as given, with no extra spaces or line breaks.
5. Leave **TTL** (Time to Live: how often the record refreshes) set to **Auto**.
6. Click **Save**.

## Important: turn the proxy off for this record

Cloudflare shows a small cloud icon next to every DNS record. This icon can be either:

- **Orange cloud (Proxied)**: Cloudflare routes traffic through its own servers first. This is normally used for websites, not email.
- **Grey cloud (DNS only)**: the record points directly to its destination, with no extra routing in between.

**Your new TXT record must be set to grey cloud (DNS only), not orange (Proxied).** Email programs read DKIM records directly and don't understand Cloudflare's proxy. If the record is proxied, mailbox providers like Gmail and Outlook won't be able to verify it, and your DKIM check will keep failing.

TXT records are usually grey by default and don't show a cloud toggle at all, since proxying only applies to certain record types (like A and CNAME, a CNAME record points one domain name to another). Still, it's worth double-checking the record right after you save it. If you see a cloud icon next to it, click it once so it turns grey before moving on.

## Step 4: Wait, then check Warmerly

Warmerly automatically rechecks your domain in the background. You don't need to click anything else on our side unless a manual step below applies to you.

## Step 5: If Warmerly still shows "No DKIM signature found," add the selector manually

Warmerly checks dozens of common selector names automatically. If it still can't find your record after your DNS change has had time to go live, add the selector by hand:

1. In Warmerly, go to **Accounts**.
2. Click into the mailbox you're setting up.
3. Go to **Settings**.
4. Find the **DKIM selector** field and enter your selector (just the short label, like `google`, not the full `._domainkey.yourdomain.com` part).

## A note on timing

DNS changes can take up to **24-48 hours** to fully take effect everywhere on the internet. In practice, Cloudflare is one of the fastest DNS hosts around, changes often show up within a few minutes to an hour. If Warmerly still shows "No DKIM signature found" right after you save the record, don't worry. Check back a little later before troubleshooting further.

Next, publish the DMARC record: [DMARC on Cloudflare](https://warmerly.com/docs/guides/dmarc/cloudflare).

## More in Guides

- [DKIM on GoDaddy](https://warmerly.com/docs/guides/dkim/godaddy): Step-by-step instructions to add a DKIM TXT record to a domain managed in GoDaddy DNS, so Warmerly can…
- [SPF & DMARC records](https://warmerly.com/docs/guides/spf-dmarc): Fix an SPF or DMARC warning in Warmerly by adding the right DNS records to your domain, with plain-English…
- [SPF on Namecheap](https://warmerly.com/docs/guides/spf/namecheap): Step-by-step: add an SPF TXT record to a domain managed in Namecheap DNS, avoid the duplicate-record…