Point Hostinger business email at Cloudflare DNS
Moving DNS to Cloudflare without taking email down. The exact records, the orange-proxy mistake, and how to confirm it works before anyone writes to you.
Short answer
When you move a domain to Cloudflare, the MX records get copied but SPF, DKIM and the autodiscover record usually get lost. You have to recreate them by hand and, this is the critical part, leave every mail record with the proxy turned off, in gray. An MX or mail record behind Cloudflare's orange proxy stops receiving messages.
- Last verified
- May 28, 2026
Antes de empezar necesitas
- A domain already added to Cloudflare
- Access to your provider's email panel to copy the records
- Patience: DNS changes can take a while to propagate
Moving DNS to Cloudflare improves site speed and gives you access to caching and security rules. It is also the operation that most often takes down a company's email, almost always because of the same detail.
1. Write down the current records before touching anything
Go into your current provider's DNS panel and save a screenshot of everything. In particular:
- The MX records with their priority
- The SPF TXT record, which starts with
v=spf1 - The DKIM TXT records, usually on a subdomain such as
hostingermail._domainkey - The autodiscovery CNAMEs, such as
autodiscoverorautoconfig
This step looks like paperwork and it is the one that saves you when something does not arrive.
2. Check what Cloudflare imported
When you add the domain, Cloudflare scans and copies what it finds. Compare its list with your screenshot. Anything missing, add by hand.
3. Recreate SPF and DKIM
SPF is a TXT record at the root of the domain. There can only be one: if you use several sending services, they are combined into the same line.
DKIM is one or more TXT records on specific subdomains. Copy them exactly as your provider gives them, with no extra spaces or line breaks.
4. Add DMARC if you did not have it
A TXT record at _dmarc with a monitoring policy is a good starting point:
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
With p=none you reject nothing: you only receive reports on who is sending in your name. Once you confirm that only your legitimate services show up, you can tighten the policy.
5. Check before you go to sleep
Send an email from an external account to your domain. Reply from your domain to that account. In Gmail, open the received message, choose Show original and confirm that SPF and DKIM say PASS.
Common mistakes
Leaving two SPF records. The standard only allows one; with two, the checks fail and your emails start landing in spam.
Changing the nameservers before reviewing the records. Do it the other way round: first verify that the zone in Cloudflare is complete, then change the nameservers at the registrar.
Only testing by sending. Mail going out does not mean mail coming in. Test both directions.
Frequently asked questions
Why does email break when you move the DNS?
Cloudflare imports most records when it scans your zone, but the scan does not always find everything, especially DKIM TXT records and autodiscover records. Whatever was not imported simply stops existing.
What does the orange icon mean?
That Cloudflare is acting as a proxy: traffic goes through its network and the real IP stays hidden. That is good for a website and terrible for email, because Cloudflare does not route SMTP. Mail records always go gray.
How long does it take to propagate?
With Cloudflare it is usually a matter of minutes, but your previous provider's TTL can keep old values cached for hours. If something does not work right away, wait before changing anything else.
How do I check that it worked?
Send a test email from an external account, Gmail for example, and reply from your domain. Check the header of the message you received: SPF and DKIM should show as 'pass'.
