Cloudflare DNS

If your DNS is at Cloudflare, the domain page shows Set up with Cloudflare: sign in and approve the records. To add them by hand, follow the steps below.

In Cloudflare, the six records live under your domain's DNS tab: open the zone, choose DNS, then Records, and use Add record for each value Mailfully returned. Field names below are current as of September 2026.

Add the records

Add the three DKIM CNAMEs

Mailfully returns three DKIM tokens, and each one needs its own record:

Field	Value
Type	CNAME
Name	`<token>._domainkey.mail`
Target	`<token>.dkim.mailfully.com`
TTL	Auto

Before saving, confirm the record will land at <token>._domainkey.mail.acme.com, not at that name with .acme.com appended a second time.

Add the MAIL FROM MX record

Field	Value
Type	MX
Name	`send.mail`
Mail server	`feedback-smtp.us-east-1.amazonses.com`
Priority	10

Add the MAIL FROM SPF record

Field	Value
Type	TXT
Name	`send.mail`
Content	`v=spf1 include:_spf.mailfully.com ~all`

Add the DMARC record

Field	Value
Type	TXT
Name	`_dmarc.mail`
Content	`v=DMARC1; p=none;`

Turn the proxy off

Cloudflare can proxy any CNAME through its own network, shown as an orange cloud next to the record. A proxied DKIM CNAME resolves to one of Cloudflare's addresses instead of <token>.dkim.mailfully.com, so the DKIM lookup made during verification finds the wrong target and the record never verifies. Set every DKIM CNAME to DNS only (grey cloud). MX and TXT records have no proxy toggle at all, so the MX, SPF, and DMARC records are unaffected either way.

If you use Cloudflare Email Routing

Email Routing manages MX records for the name it is enabled on, which defaults to your zone's apex, acme.com; Mailfully's MX record sits on send.mail.acme.com, so the two don't collide. If you enabled Email Routing on a subdomain, check it isn't send.mail.acme.com; see MX record conflicts.

Verify

dig +short <token>._domainkey.mail.acme.com CNAME
dig +short send.mail.acme.com MX
dig +short send.mail.acme.com TXT
dig +short _dmarc.mail.acme.com TXT

The DKIM lookups are the ones to read closely here, since a proxied record answers with a Cloudflare address rather than the DKIM target. Verify with dig lists the expected answer for each lookup.