ParsonsHosting

Email and DNS

How do I set up email and SSL when my domain's DNS is on Cloudflare?

By Chris Parsons, founder of ParsonsHosting. Published .

If your domain uses Cloudflare's nameservers, we can't publish your email authentication records for you. Contact our support team for the exact records for your domain, add them in Cloudflare as DNS only, keep every mail-related name DNS only, and set Cloudflare's SSL/TLS mode to Full (strict). If you keep our nameservers instead, we handle these records for you.

Person working on a laptop at a wooden desk in warm natural light

Before you move your DNS to Cloudflare

Know the trade-off. On ParsonsHosting nameservers, we publish your email authentication records for you, automatically. When your DNS moves to Cloudflare, we can no longer do that. You then need to do one of these:

  • Ask us for your records and add them in Cloudflare yourself (Option A in Step 2), or
  • Use your own sending setup, such as your own SendGrid account or another email service (Option B in Step 2).

If you do neither, your email is not stopped. But it may go to spam or be turned away by the people you send to, especially if your domain has a strict DMARC policy (p=quarantine or p=reject). This only affects email sent from our server: contact forms, WordPress notifications and mail from your cPanel mailboxes. Your website keeps working.

If you would rather not manage this, keep our nameservers and we take care of it.

Why this matters

Email sent from your website or cPanel mailboxes goes out through our server and our mail delivery service. Gmail, Outlook and other inboxes check three records before they trust a message:

  • DKIM is a digital signature that proves an email really came from you and was not changed on the way.
  • SPF is a list of the servers allowed to send email for your domain.
  • DMARC tells inboxes what to do with mail that fails those checks, and where to send reports about it.

A DNS record is one line in your domain's settings that tells the internet where things live. Your nameservers decide who holds those settings. If they are Cloudflare's, we cannot add or update these records for you.

Grey cloud vs. orange cloud

Each record in Cloudflare has a proxy status. Proxied (orange cloud) sends website traffic through Cloudflare first. DNS only (grey cloud) points straight at our server.

Cloudflare can only proxy A, AAAA and CNAME records. MX and TXT records are always DNS only. Mail itself (sending and checking mail in an app) does not work through Cloudflare's proxy.

Keep these DNS only:

  • The hostname your MX record points to. The MX record tells the world where to deliver your email. If the name it points to is proxied, incoming mail breaks.
  • mail, webmail, cpanel, autodiscover and autoconfig, if you have them.
  • Every email authentication record (DKIM, SPF, DMARC and any SendGrid records), whether TXT or CNAME.

Your website records (usually your domain itself and www) can stay proxied.

Note: DNS only shows our server's address to anyone who looks it up. That is normal for mail, and it is how mail worked before you moved to Cloudflare.

Step 1: Point mail at a DNS-only name

cPanel often sets your MX record to your domain itself (for example, example.com). On Cloudflare that name is usually proxied, so mail sent to it fails. If your mailboxes are on ParsonsHosting:

  1. In Cloudflare, go to DNS > Records.
  2. Add an A record named mail that points to your ParsonsHosting server's IP address. Set it to DNS only. If you do not know the IP address, ask us.
  3. Edit your MX record (name @) so it points to mail.yourdomain.com.
  4. Check that webmail, cpanel and any autodiscover records are set to DNS only.

If your mailboxes are with Google Workspace, Microsoft 365, Proton or another provider, keep that provider's MX records instead.

Step 2: Get your email authentication records

Choose one option.

Option A: Ask us for your records (supported)

  1. Opening a support ticket is the best way to reach us. You can also email support@parsonshosting.com or call 530-710-8726. Ask for your domain's email authentication DNS records.
  2. We send you the exact records for your domain. These include your DKIM record, any SendGrid records, and your SPF record.
  3. In Cloudflare, go to DNS > Records and add each record exactly as we send it: the same type, name and value.
  4. Set any CNAME records to DNS only. If Cloudflare offers to flatten them, leave them as plain CNAME records.

As an example only, the records may look like a TXT record named default._domainkey, or CNAME records named like s1._domainkey and s2._domainkey. Yours may be different. Always use the exact records we send you. One missing character breaks a record.

Option B: Use your own sending setup (not supported by ParsonsHosting)

You can send your website's mail through a service you choose. You set it up and keep it working. We do not support or troubleshoot these services. Common examples:

  • Your own SendGrid account (set up Sender Authentication in your SendGrid account, then add the records it gives you in Cloudflare, DNS only)
  • Amazon SES (Amazon Simple Email Service)
  • Mailgun
  • Postmark
  • Brevo (formerly Sendinblue)
  • SMTP2GO
  • Google Workspace SMTP relay
  • Microsoft 365 SMTP (SMTP AUTH or an SMTP relay connector)

If you choose Option B:

  • Your SPF and DKIM records must match that provider. Use the records their setup screens give you, and keep your SPF record to one combined line (see Step 3).
  • WordPress sites usually connect to these services with an SMTP plugin. As with any plugin, you add it at your own risk.
  • Pricing, limits and setup are set by each provider. Check their current documentation.

Step 3: Keep exactly one SPF record

Our standard SPF record for domains hosted with ParsonsHosting is:

v=spf1 +a +mx +ip4:157.230.174.7 include:sfo-1.serverparsons.com ~all

The include:sfo-1.serverparsons.com part already covers our SendGrid sending. You do not need to add SendGrid separately. cPanel's Email Deliverability page may suggest a value without this part, so use the SPF record we send you, not cPanel's suggestion.

Your domain can have only one SPF record (one TXT record starting with v=spf1). Two SPF records make both fail.

If you also send mail from another service, add that service's include: before the ending ~all. Do not add a second SPF record. Examples:

  • Google Workspace: v=spf1 +a +mx +ip4:157.230.174.7 include:sfo-1.serverparsons.com include:_spf.google.com ~all
  • Proton Mail: v=spf1 +a +mx +ip4:157.230.174.7 include:sfo-1.serverparsons.com include:_spf.protonmail.ch ~all

For any other service, including Option B providers, use the include: value from that service's own setup instructions. Keep our part too if any mail still goes out from your hosting account, such as cPanel mailboxes.

SPF has a limit: checking it may take no more than 10 DNS lookups. Each include:, a and mx counts, and some includes count more than once. Our standard record already uses about 7. So add only the services you really use, and remove ones you no longer use. If you need help counting, ask us.

Step 4: Add a DMARC record

  1. In Cloudflare, add a TXT record named _dmarc, if you do not already have one.
  2. Start with a value like v=DMARC1; p=none; rua=mailto:you@yourdomain.com. p=none means "just report, do not block." The rua address receives daily reports.
  3. Watch the reports for a few weeks. When your real mail passes, you can tighten it to p=quarantine (send failures to spam) and later p=reject.

If you already have p=quarantine or p=reject, make sure your DKIM and SPF records are in place first. Otherwise more of your mail will be sent to spam or turned away.

Cloudflare has a free tool for this: Email > DMARC Management. It reads your DMARC reports and shows who is sending mail as your domain. When you turn it on, it adds a Cloudflare report address to your DMARC record. It also warns you if your SPF record goes over the 10-lookup limit.

Step 5: Set SSL/TLS to Full (strict)

SSL is what puts the padlock and https:// on your site. Every ParsonsHosting site gets a free Let's Encrypt certificate through cPanel's AutoSSL, which renews on its own. For other security basics, see how to keep your WordPress site secure and up to date.

  1. In cPanel, open Security > SSL/TLS Status. Make sure your domain and www show an active AutoSSL certificate.
  2. In Cloudflare, go to SSL/TLS > Overview.
  3. Choose Full (strict). If you see Automatic and Custom options, choose Custom first.

Do not use Flexible. Flexible connects Cloudflare to our server without encryption. Your site also redirects to https://, so Flexible causes a redirect loop ("too many redirects"). If cPanel does not show an active certificate yet, Full (strict) will show an error page. In that case, contact us before changing anything.

Renewals behind Cloudflare: AutoSSL proves you own the domain by loading a small file from /.well-known/acme-challenge/ on your site. Cloudflare passes that request through to us. Renewals work as long as Cloudflare does not block that path. If a security rule, Bot Fight Mode or Under Attack mode blocks it, renewal fails. If cPanel emails you about an AutoSSL problem, check those settings or contact us.

Step 6: Caching

Caching means saving a ready-made copy of a page so it loads faster. NGINX caching is already on for every ParsonsHosting account, so you usually do not need extra caching rules in Cloudflare. To learn how to clear it, see how to make your WordPress site load faster.

  • By default, Cloudflare caches files like images, CSS and JavaScript, but not your pages (HTML).
  • If you add a Cloudflare rule to cache whole pages, exclude /wp-admin, login pages, logged-in visitors, carts and checkout. Otherwise visitors may see someone else's cart or an old page.
  • After you change your site, clear both caches. In cPanel, find NGINX Caching and click Clear Cache. In Cloudflare, go to Caching > Configuration and use Purge Cache. Cloudflare suggests purging single URLs when you can, rather than everything.

Step 7: Watch your security settings

Cloudflare's protection can block traffic you need:

  • Under Attack mode shows a check page to every visitor. It is meant for active attacks. Turn it off when the attack is over.
  • Bot Fight Mode (in Security > Settings) challenges traffic that looks automated. It cannot be skipped with custom rules.
  • WAF rules (firewall rules) you add yourself.

All of these can block contact form submissions, payment notifications from Stripe or PayPal, WordPress background tasks (WP-Cron), the WordPress REST API and AutoSSL renewals. If something stops working after you turn one on, turn it off and test again. To test a form step by step, see how to add a contact form to your WordPress site.

If our records change

Your records rarely change. If they do, we'll email you the new values. Update the matching records in Cloudflare when you get that email. On our nameservers, this happens for you.

To ask for your current records at any time, open a support ticket. Opening a ticket at https://parsonshosting.com/submitticket.php is the best way to reach us. We reply the same day, often within an hour, during business hours (8:00 AM to 5:00 PM Pacific, 7 days a week).

Rather have us handle it?

You can switch your domain to ParsonsHosting nameservers. We then publish and update your email authentication records for you.

  1. Contact us so we can check your records before the switch. Our nameservers are conrad.serverparsons.com and john.serverparsons.com.
  2. If DNSSEC is turned on, turn it off at your domain registrar first and wait for it to clear. Otherwise your domain can stop working after the switch.
  3. At your domain registrar (where you bought the domain), replace Cloudflare's nameservers with conrad.serverparsons.com and john.serverparsons.com. Changing them inside Cloudflare does nothing.
  4. If your domain is registered with Cloudflare Registrar, you must transfer it to another registrar first.

Checklist

  • Decided: ask us for your records (Option A) or use your own sending setup (Option B)
  • Every record we sent you (or your provider gave you) added exactly, DNS only
  • One SPF record: our standard value plus any other service you send from
  • DMARC record in place, starting at p=none if it is new
  • MX points to a DNS-only name (for example, mail.yourdomain.com)
  • mail, webmail, cpanel and autodiscover are DNS only
  • cPanel SSL/TLS Status shows an active certificate
  • Cloudflare SSL/TLS set to Full (strict), not Flexible
  • No page-caching rule on admin, login, cart or checkout pages
  • Test email sent from your contact form and a cPanel mailbox, and checked for the spam folder
  • You'll update Cloudflare if we email you new record values

FAQ

What happens if I move to Cloudflare and don't add these records?

Your email keeps sending, but it may go to spam or be turned away, especially with a strict DMARC policy. This affects contact forms, WordPress notifications and cPanel mailboxes. Your website keeps working.

Do I have to turn off Cloudflare's proxy for my whole site?

No. Your website records can stay proxied (orange cloud). Only mail-related names and records need to be DNS only.

Why is my email going to spam after moving DNS to Cloudflare?

Usually the email authentication records did not come across, or there are two SPF records. Contact us for the exact records for your domain and compare each one in Cloudflare.

Can I use Cloudflare's Flexible SSL mode?

No. It causes redirect loops on ParsonsHosting sites and leaves the connection to our server unencrypted. Use Full (strict).

Who supports a sending service I set up myself?

You and that provider do. We support the records we send you (Option A). We do not support services in Option B.

Get help

Opening a support ticket is the best way to reach us. You can also email support@parsonshosting.com or call 530-710-8726. See the FAQ for more.

See all articles