Email Not Working After Switching to Cloudflare? Fix It

Quick answer

Email not working after switching to Cloudflare? The usual cause is a mail hostname (often mail.example.com, or the domain your MX record points to) set to Proxied. Cloudflare’s proxy only handles web traffic, so SMTP, IMAP and POP3 break. Set every mail-related A, AAAA and CNAME record to DNS only, then check that your MX, SPF, DKIM and DMARC records were copied across correctly.

Your website loads fine through Cloudflare, but inbound mail bounces, Outlook keeps asking for the password, or the phone mail app says it cannot connect to the server. That is the classic case of email not working after switching to Cloudflare, and it is almost always a DNS record problem rather than a problem with your mailbox.

The good news: your mailbox and the messages already in it are untouched. Once the records are right, new mail starts flowing again. Below is how to find the exact record at fault, fix it, and how to move the next domain to Cloudflare without breaking email at all.

This guide covers cPanel hosting mailboxes as well as external providers like Google Workspace and Microsoft 365. The steps in the Cloudflare dashboard are the same either way.

Why email stops working after switching to Cloudflare

When you point your nameservers at Cloudflare, Cloudflare becomes the only place your DNS lives. Two things can go wrong at that moment: records get proxied that should not be, or records never make it across.

How a message finds your mailbox

MX recordSays which hostname accepts mail for example.com, for example mail.example.com.
A or AAAA record for that hostnameTurns mail.example.com into your mail server’s IP address. This is the record that must be DNS only.
Mail serverAccepts the message over SMTP. Your apps then read it over IMAP or POP3.

If step 2 returns a Cloudflare proxy IP instead of your real server IP, mail is sent to Cloudflare, which does not accept it.

Cloudflare’s own documentation is clear on the main cause: “Mail protocols such as SMTP, IMAP, and POP3 do not work through Cloudflare’s standard HTTP proxy.” The proxy (the orange cloud) is built for websites. When a mail hostname is proxied, DNS hands out Cloudflare’s IP addresses, and mail clients and other mail servers try to connect to Cloudflare instead of your mail server.

Only A, AAAA and CNAME records can be proxied. MX and TXT records are always DNS only, so you will not see an orange cloud on them. That is exactly why this catches people out: the MX record looks fine, but the hostname it points to is proxied.

On client sites we’ve seen this most often on cPanel accounts where the MX record points at the bare domain (example.com) instead of mail.example.com. The bare domain has to be proxied for the website to use Cloudflare, so the moment you turn the orange cloud on, mail delivery to that MX breaks too.

Find the cause: symptoms and fixes at a glance

Match what you are seeing to the most likely cause before you start changing records.

Symptom	Likely cause	Fix
Outlook, Apple Mail or phone app can’t connect; website is fine	`mail.example.com` is Proxied	Set that record to DNS only
Incoming mail bounces or never arrives	MX points to a proxied hostname, or the MX record is missing	Point MX to a DNS only mail hostname; re-add missing MX
Outgoing mail lands in spam or gets rejected	SPF, DKIM or DMARC TXT records not copied to Cloudflare	Re-add them from your host or provider
Microsoft 365 or Outlook setup fails on a new device	`autodiscover` CNAME proxied or missing	Re-add it as DNS only
Provider says it can’t find its verification CNAME	CNAME flattening is changing the record	Turn off CNAME flattening
Mail goes to a Cloudflare forwarder instead of your mailbox	Cloudflare Email Routing is on	Turn off Email Routing, then add your provider’s MX
Error: “Existing non-Cloudflare MX records conflict with Email Routing”	You tried to enable Email Routing while another provider’s MX records exist	See the Email Routing MX conflict section

The first three rows cover nearly every case we see after a Cloudflare move. Start there.

Fix email not working after switching to Cloudflare, step by step

Step 1: Check what your MX record points to

In the Cloudflare dashboard, open your domain and go to DNS > Records.
Type MX into the search box above the records list, or sort by type.
Note the Mail server value. For cPanel hosting this is usually mail.example.com or example.com. For Google Workspace or Microsoft 365 it will be a Google or Microsoft hostname.
If there is no MX record at all, the import missed it. Add it back using the values from your old DNS provider or your email provider’s setup page.

You can also check from your computer. On Mac or Linux, run dig example.com mx +short in Terminal. The result should match the MX record you see in Cloudflare.

Step 2: Set every mail hostname to DNS only

Still on DNS > Records, find the A, AAAA or CNAME record for the hostname your MX points to (for example mail).
Click Edit and switch Proxy status from Proxied (orange cloud) to DNS only (grey cloud). Click Save.
Repeat for other mail-related hostnames you use: smtp, imap, pop, webmail if your app connects to it for mail, and autodiscover.

Leave example.com and www proxied. Your website should keep using Cloudflare. Only the hostnames mail apps and mail servers connect to need the grey cloud.

Step 3: If your MX points at the bare domain, give mail its own hostname

This is the cPanel case from earlier. You cannot set example.com to DNS only without taking your website off Cloudflare, so split mail onto its own name instead.

Find your mail server’s IP address. Copy it from the old DNS zone at your previous provider, or ask your host. On a single cPanel server it is usually the same IP your website’s A record pointed to before Cloudflare.
Add an A record: Name mail, IPv4 address = that IP, Proxy status DNS only.
Edit the MX record so Mail server is mail.example.com. Keep the same priority.
Update your mail apps to use mail.example.com as the incoming and outgoing server if they used the bare domain.

This matches the setup Cloudflare documents for running your own mail server: an A or AAAA record for the mail subdomain set to DNS only, and an MX record pointing to that subdomain.

Step 4: Re-add SPF, DKIM and DMARC records

If mail flows but outgoing messages land in spam, the authentication TXT records probably did not come across. Cloudflare’s troubleshooting guide lists missing SPF, DKIM and DMARC as a common cause: without SPF, receiving servers “cannot verify that your domain authorizes the sending server”.

For cPanel mailboxes, the quickest way to get the correct values is cPanel > Email > Email Deliverability. Click Manage next to the domain. If it shows Problems Exist, copy the suggested SPF and DKIM records and add them as TXT records in Cloudflare. cPanel’s documentation notes that when your server is not the authoritative nameserver, you must add the record at your nameserver provider, which is now Cloudflare.

A domain should have one SPF record: the SPF standard (RFC 7208) says a domain must not publish more than one. If you send through more than one service (for example cPanel mail plus a newsletter tool), merge them into a single v=spf1 ... ~all TXT record rather than adding a second one.

For Google Workspace and Microsoft 365, copy the DKIM and SPF values from their admin consoles. Never guess the DKIM key: it is unique to your domain.

Step 5: Rule out Email Routing and CNAME flattening

Email Routing: if you or someone else tried Cloudflare’s free forwarding, it manages its own MX records. Cloudflare’s guide says to turn off Email Routing when you use another mail provider, then add that provider’s MX records. If Cloudflare shows an MX conflict error instead, jump to that section.
CNAME flattening: it turns CNAMEs into A records in DNS answers. If your provider needs to read a CNAME (common for DKIM and verification records), turn flattening off for it.

Step 6: Test again

Run dig mail.example.com +short. You should now see your mail server’s real IP, not a Cloudflare address. Then send a test message from an outside account such as a personal Gmail to your domain, and reply to it. If DNS was cached, give it the length of the old record’s TTL before testing again.

Setting mail records to DNS only reveals your server’s IP address. If your website and mail run on the same server, that IP is now public, and Cloudflare warns that bounced emails can expose it too. Cloudflare’s advice is to host mail separately from the web server you are protecting. For most small business sites this is an acceptable trade-off, but if you moved to Cloudflare to hide your origin from attacks, use a separate mail provider.

Error: “Existing non-Cloudflare MX records conflict with Email Routing”

You see this message when you try to turn on Cloudflare Email Routing while the domain still has MX records for another mail provider, such as your cPanel host, Google Workspace or Microsoft 365. Email Routing is a forwarding service and needs Cloudflare’s own MX records on the domain (route1.mx.cloudflare.net, route2.mx.cloudflare.net and route3.mx.cloudflare.net). A domain can only send its incoming mail to one place, so Cloudflare’s documentation says to remove or update the existing MX records before Email Routing can continue.

Before you click anything, decide which of these you actually want:

What you want	What to do	Watch out for
Keep your real mailboxes (cPanel, Google, Microsoft)	Don’t enable Email Routing. If it is already on, turn it off in the domain’s Email Routing settings, then re-add your provider’s MX records.	Cloudflare notes that Email Routing’s MX records can conflict with another provider’s. Only one of them can own the MX.
Only forward addresses, for example info@ to a Gmail inbox	Delete the old MX records in Cloudflare’s DNS records, then enable Email Routing.	Mailboxes at your old host stop receiving new mail as soon as the MX changes. Export or back up anything you need first.

Delete old MX records in Cloudflare’s DNS records, not at your registrar or old DNS host. Once your nameservers point to Cloudflare, only Cloudflare’s DNS zone is used, so removing records anywhere else changes nothing and the error will keep coming back.

If you keep sending mail from another service as well, keep a single SPF record that includes both. Cloudflare’s example for a domain that also sends through Google is v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all. When you are done, run dig example.com mx +short and check that it shows the provider you meant to use.

How to move DNS to Cloudflare without breaking email

If you have not switched yet, or you are about to move another domain, this order avoids the problem entirely.

Write down your current records first. In cPanel go to Domains > Zone Editor, click Manage next to the domain and filter by MX, then TXT, then CNAME. Screenshot or copy every mail-related record.
Add the domain to Cloudflare and let it scan your records, or import a zone file under DNS > Records > Import and Export. If you import, untick Proxy imported DNS records so nothing mail-related gets the orange cloud by accident. You can turn the proxy on for example.com and www afterwards.
Compare the lists. Cloudflare’s setup guide specifically tells you to review email records (MX, SPF, DKIM, DMARC) before going live. Every record from step 1 should exist in Cloudflare with the same value.
Check proxy status. Website records proxied, mail records DNS only.
Disable DNSSEC at your registrar before changing nameservers. Cloudflare warns that changing nameservers with DNSSEC still active can make the domain unreachable.
Change the nameservers at your registrar, copying Cloudflare’s two nameservers exactly. Cloudflare says to allow up to 24 hours for the change.
Test mail in and out once the domain shows Active, then re-enable DNSSEC in Cloudflare.

Once the website is on Cloudflare, also check the SSL mode. A wrong setting there causes a different problem, covered in our guide to fixing the Cloudflare too many redirects SSL loop.

Website form emails are a separate problem

If your mailbox works but WordPress contact form notifications still go missing, Cloudflare is probably not the cause. WordPress sends through PHP mail by default, which is often blocked or filtered. Our walkthrough on fixing WordPress contact form emails with SMTP covers that fix, and the SPF and DKIM records above will help those messages too.

The short version

Email not working after switching to Cloudflare almost always means a mail hostname is proxied or a mail record was not copied. Set mail hostnames to DNS only, make sure the MX points to a DNS only hostname rather than the proxied bare domain, re-add SPF, DKIM and DMARC, then test with dig and a real message.

Frequently asked questions

Should MX records be proxied in Cloudflare?

They can’t be. Cloudflare only proxies A, AAAA and CNAME records, so MX records are always DNS only. What matters is the hostname the MX points to: that A, AAAA or CNAME record must also be DNS only.

Does Cloudflare affect email?

Cloudflare does not handle your email unless you turn on Email Routing. It only serves the DNS records that tell other servers where your mail goes. Email breaks when those records are missing, wrong, or proxied.

How long does it take for email to work after changing nameservers?

Cloudflare says nameserver changes can take up to 24 hours. After you fix a record inside Cloudflare, other servers pick up the change once their cached copy of the old record expires, which depends on that record’s TTL.

Is it safe to set mail records to DNS only?

It is required for mail to work, but a DNS only record shows your server’s real IP. If the same server hosts your website, that IP can be used to reach the site directly and skip Cloudflare. Mail will still work; the safer long-term setup is a separate mail host.

What does “Existing non-Cloudflare MX records conflict with Email Routing” mean?

Cloudflare Email Routing needs its own MX records on the domain, and your domain still has MX records for another mail provider. You have to choose one: keep your current provider and leave Email Routing off, or delete the old MX records in Cloudflare’s DNS and use Email Routing for forwarding only.

Sources: Cloudflare: Email issues; Cloudflare: Proxy status; Cloudflare: Set up email records; Cloudflare: Email Service domain configuration; Cloudflare: Full setup; Cloudflare: Import and export records; cPanel: Email Deliverability; RFC 7208 (SPF). Checked October 2026.

Tagged Cloudflare, DNS, Email