Cloudflare DMARC Management hits general availability

Cloudflare has announced that its DMARC Management tool is now generally available. The service, which was previously offered free to all Cloudflare customers, comes with a redesigned dashboard aimed at simplifying the process of achieving full DMARC enforcement.

The company's stated goal is to make strong email authentication accessible to every domain owner, removing the need for professional services engagements or manual parsing of XML aggregate reports. The new experience is designed to guide users from a monitoring-only posture to full enforcement at their own pace.

The four pillars of email authentication

Email authentication relies on DNS records that allow receiving mail servers to verify that a message genuinely originated from the domain it claims to represent. Without these records, anyone can send email that appears to come from your domain.

  • SPF (Sender Policy Framework) defines which IP addresses and services are authorized to send email for your domain.
  • DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages so receiving servers can confirm the content wasn't altered in transit.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) unifies SPF and DKIM results, instructing receiving servers to pass, quarantine, or reject unauthenticated email, while also generating reports about senders using your domain.
  • BIMI (Brand Indicators for Message Identification) enables brand logo display in supported inboxes, but only when a sufficiently strong DMARC policy is in place.

Proper configuration of all four protocols prevents spoofed messages from reaching inboxes and improves deliverability for legitimate correspondence. Misconfiguration or missing records expose domains to impersonation and deliverability penalties.

Why enforcement now matters more

The urgency around DMARC has intensified over the past two years as Google, Microsoft, and Yahoo have implemented stricter authentication enforcement. Domains with missing or improperly configured DMARC, SPF, and DKIM records are increasingly finding legitimate email rejected or routed to spam folders.

What was once a best practice has become a requirement. Poor email authentication directly impacts deliverability, which for many organizations translates into lost revenue and missed communications.

The challenge: getting to enforcement safely

The path from p=none (monitor only) to p=quarantine (suspicious email sent to spam) to p=reject (unauthenticated email blocked) is fraught with risk. Moving to enforcement too quickly can break legitimate email flows from third-party services that were forgotten or overlooked. Moving too slowly leaves a domain exposed to spoofing and deliverability penalties.

Understanding aggregate XML reports, identifying every legitimate sending source, and building confidence that a stricter policy won't break anything has traditionally required significant manual effort.

What the GA release includes

Source-level investigation

The redesigned reporting view shows which sending sources are passing or failing DMARC, SPF, and DKIM alignment. Each report now includes the source IP address alongside the sending service, making it possible to distinguish legitimate infrastructure from unauthorized senders.

IP addresses can be opened directly in the Investigate tab, which surfaces Cloudflare's threat intelligence on that address, including reputation data, geolocation, autonomous system number (ASN) details, and any known malicious associations. This shifts DMARC reports from a passive data feed to an active investigation tool.

Record status at a glance

A common question — "Are my records set up correctly?" — previously required manually inspecting DNS TXT records and interpreting tags and values from multiple specifications. The new release consolidates status for all four record types — DMARC, DKIM, SPF, and BIMI — into a single view.

Each record receives a pass, warning, or fail status based on automated analysis. Drilling into any record reveals specific findings and plain-language recommendations for remediation. Malformed DKIM keys are flagged, as is the absence of a BIMI record when the DMARC policy is strong enough to support one.

SPF lookup audit

The SPF specification (RFC 7208) imposes a hard limit of 10 DNS lookups per SPF evaluation. Each include:, a, mx, redirect, and exists mechanism counts toward the limit, as do nested lookups within each include:. Exceeding 10 lookups results in a permerror, causing the SPF check to fail entirely.

Many organizations exceed this limit without realizing it until email starts getting rejected. The new audit shows exactly how many lookups an SPF record incurs, allowing users to examine every mechanism, identify the most expensive include: chains, and consolidate or flatten records to get back under the limit.

Getting started

DMARC Management requires that the domain's DNS be on Cloudflare. From there, the service is available under the Email tab for the domain in the Cloudflare dashboard.

  1. Navigate to your domain in the Cloudflare dashboard.
  2. Go to Email > DMARC Management.
  3. Follow the setup wizard to start receiving DMARC reports.
  4. Review your record analysis and recommendations.
  5. Work toward p=quarantine or p=reject at your own pace.

Roadmap

Cloudflare plans to continue building on DMARC Management with deeper forensic reporting, smarter recommendations, and tighter integration with the broader Cloudflare platform. The company states its intention is to keep the tool accessible and available at no additional cost.

For domains not yet on Cloudflare DNS, the service becomes available immediately once the domain is onboarded, with no further configuration or fees required.