Guide Configure Mail DNS Records in Cloudflare for aaPanel - Printable Version +- AdminsForum (https://adminsforum.com) +-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels) +--- Forum: aaPanel (https://adminsforum.com/Forum-aapanel) +---- Forum: aaPanel Guides & Tutorials (https://adminsforum.com/Forum-aapanel-guides-tutorials) +----- Forum: aaPanel Mail Server Guides (https://adminsforum.com/Forum-aapanel-mail-server-guides) +----- Thread: Guide Configure Mail DNS Records in Cloudflare for aaPanel (/Thread-guide-configure-mail-dns-records-in-cloudflare-for-aapanel)

Configure Mail DNS Records in Cloudflare for aaPanel - DEV - 10-11-2026 aaPanel generates your mail-domain record values; Cloudflare publishes them when Cloudflare hosts your domain's authoritative DNS. Tested: The lab's A, MX, SPF, DKIM and DMARC records were published in Cloudflare. Public DNS lookups returned them, and a real outbound message passed SPF, DKIM and DMARC at Mail-Tester. 1. Get the values from aaPanel Open Mail Server → Mail Domain → DNS Record for your domain. Keep this screen open. It shows the mail hostname, MX priority, SPF text, unique DKIM public key and DMARC value. You must use your own generated DKIM key. 2. Open Cloudflare DNS Select your domain in Cloudflare, then DNS → Records. Inspect existing records first. If you already use another mail provider, changing MX and SPF changes that existing setup; plan the migration before replacing records. Our lab had no previous MX record. 3. Add the mail A and MX records Click Add record. Select type A, name mail, and your VPS IPv4 address. Turn proxy status off so it reads DNS only, then Save. Add another record: type MX, name @, mail server mail.example.com, priority 10, TTL Auto. The MX target is a hostname, not an IP address or an https:// URL. Save. 4. Add sender-authentication TXT records Add each separately: SPF: type TXT, name @, content copied from aaPanel. Our dedicated lab used Code:Copy v=spf1 +a +mx -all This permits the A/MX senders; it is not a universal value for domains using other services. Maintain one SPF policy per name and include all legitimate senders in that policy. DKIM: type TXT, name default._domainkey in our lab, content copied in full from our domain's aaPanel screen. Your selector may differ. Copy the complete v=DKIM1 value, without the Copy button label. This publishes a public key; the private signing key stays on the server. DMARC: type TXT, name _dmarc. Our lab used Code:Copy v=DMARC1;p=quarantine;rua=mailto:[email protected] Replace the report mailbox with an address you control. For a domain with existing senders, start by assessing alignment and a monitoring policy before enforcing quarantine/reject. Our SMTP hostname also received a separate TXT SPF record at mail: Code:Copy v=spf1 ip4:YOUR_VPS_IPV4 -all This describes the HELO hostname's permitted sender; it does not replace the root-domain SPF record. 5. Verify public resolution Check A, MX and each TXT name through a public DNS resolver. Then return to aaPanel and use Already set, Verify domain name resolution. aaPanel can temporarily display a cached Not Set result; check actual public DNS before changing correct records again. What comes next Create the mailbox and mail TLS certificate. PTR/reverse DNS belongs to the VPS provider, not this Cloudflare zone. Finally send a real test message: published records alone do not prove SPF/DKIM/DMARC pass on an actual message. Screenshot: Cloudflare records used by the lab Prerequisite: Add your mail domain in aaPanel