Connect your domain on Cloudflare
Add MailFlat's five DNS records in Cloudflare, with the proxy and priority settings that trip people up.
Cloudflare wants the full record name
Paste the record name as shown, including .acme.com. In the dashboard, switch the Provider dropdown to full name so the Host column matches what this panel expects.
Where the DNS editor is
- Log in to Cloudflare
- Pick your domain
- DNS → Records
- Add record
Field names here: Name for the record name, Content (Mail server for MX) for the value, Priority for MX priority.
The five records, as Cloudflare wants them
Your real values are on Domains in the dashboard — the verification token and the DKIM key are unique to your domain. Everything else looks exactly like this.
| Type | Name | Content (Mail server for MX) | What it does |
|---|---|---|---|
| TXT | _mailflat-verify.acme.com | mf-verify-… (yours is in the dashboard) | Proves you own the domain. Verification fails without it. |
| MX | acme.com | mail.mailflat.net.Priority 10 — Priority | Routes incoming mail to MailFlat. |
| TXT | acme.com | v=spf1 include:mailflat.net ~all | Authorises MailFlat to send for your domain. |
| TXT | mail._domainkey.acme.com | v=DKIM1; k=rsa; p=… (yours is in the dashboard) | Signs your outgoing mail. |
| TXT | _dmarc.acme.com | v=DMARC1; p=none; | Tells receivers what to do when a check fails. |
Cloudflare specifics
Cloudflare is forgiving about the Name field: it accepts @, a short name, or the full host.acme.com and stores the same record either way. That tolerance is exactly why a broken habit can survive here for years and then fail the day you move to another provider.
Leave TTL on Auto.
Proxy status must be DNS only (grey cloud). Mail is SMTP, not HTTP — an orange cloud cannot proxy it.
If another MX record already uses priority 10, give ours a different number rather than duplicating it.
Then verify
Back on Domains, press Verify. If it fails, the message says what is actually wrong — including the case where your records landed one level too deep, with the exact name we found them under. DNS changes are usually visible within minutes; a failure that names a wrong record will not fix itself by waiting.
More on custom domains: Custom domains (BYOD).