Resources / DNS reference
DNS reference · Cloudflare zones
Which DNS records does ArawaMail actually add?
Calm reference for Cloudflare DNS: what ArawaMail publishes when you activate receiving and sending, what you still own, and where to copy exact values — without guessing hostnames.
Copy exact MX hosts, DKIM selectors, and MAIL FROM names from Domain details on draft day. Public docs list record kinds, not live hostnames.
ArawaMail record kinds
Receiving records vs sending records
Two activations, two record sets. Activate receiving publishes inbound MX. Activate sending publishes DKIM CNAMEs plus custom MAIL FROM MX and SPF. DMARC, MTA-STS, and TLS-RPT policy DNS are not documented as something ArawaMail writes — treat them as operator-owned unless the live product contradicts that on draft day.
Do not invent values. Public docs describe the kinds of records, not the live hostnames. Copy exact MX hosts, DKIM selector names, and MAIL FROM names from Domain details / activation screen in app.arawamail.com on draft day. If they cannot be confirmed, link that screen instead of guessing.
| Record set | What ArawaMail writes | What it means / what you do |
|---|---|---|
| Receiving — MX at apex | Inbound MX on the Cloudflare zone when you Activate receiving. Requires control of MX; existing MX elsewhere triggers confirmation before replace. See Activate receiving docs. Catch-all is one active mailbox on that domain, not a separate DNS product. | Answers “where does mail go?” Cannot share MX with Email Routing or Workspace — see ArawaMail vs Cloudflare Email Service. Migration cutover: Connect a Cloudflare domain + Move off Google Workspace. Keep DNS-only (not proxied) — proxied mail names produce _dc-mx surprises. |
| Sending — DKIM CNAMEs | DKIM CNAMEs on Enable sending. Creates or retrieves outbound identity. See Enable sending docs. Rotation guidance: DKIM key rotation. | CNAMEs point at signer key. Selectors are per vendor — do not share one selector across two stacks. Both mailbox and API sending require sending-active. |
| Sending — custom MAIL FROM | Custom MAIL FROM domain with MX + SPF (TXT) on Enable sending. | SPF authorizes MAIL FROM / Return-Path. Bounce-domain alignment, not rDNS. See From, Reply-To, Return-Path, Two vendors, one From address, SPF 10-lookup limit. |
| Operator-owned — DMARC | Not documented as written by ArawaMail. | DMARC at _dmarc.<from-domain>, from visible From domain. Bulk senders need SPF + DKIM + DMARC (at least p=none). Learn in SPF, DKIM, DMARC explained, How to read DMARC reports, auth on subdomains. RFC 9989 DMARCbis tags only via that subdomain article — not explained here. |
| Operator-owned — MTA-STS / TLS-RPT | Not documented as written by ArawaMail. | You own policy DNS + file. Check via /tools checkers. |
| Not DNS — webhooks, BIMI, PTR | Not published by activation. | Outgoing webhooks are HTTP, not DNS. No documented BIMI or PTR writer. PTR belongs to IP owner — see Reverse DNS and PTR. |
Onboarding order: add domain → active Cloudflare zone with exact name match → Activate receiving → Activate sending → create accounts. Reset disconnects the domain; remote Cloudflare cleanup is best-effort. Requirements: Overview, Cloudflare requirements, Onboard a domain.
Cutover warnings live in Connect a Cloudflare domain — not rewritten here.
Verification
Verify without turning this into a wizard
You activated in ArawaMail — now confirm Cloudflare shows what you expect, then publish what you still own. Use /tools checkers; do not paste guessed hostnames.
-
1
Confirm receiving MX
Open Cloudflare DNS for the exact domain name. Confirm apex MX now routes to ArawaMail. If old Workspace, cPanel, or Email Routing MX is still there, plan the cutover in the Cloudflare connect guide — receiving cannot share MX.
-
2
Confirm DKIM CNAMEs + MAIL FROM
Copy DKIM selector hosts + targets and MAIL FROM hostname + MX/SPF exactly from Domain details / sending activation. Confirm CNAMEs resolve and MAIL FROM TXT authorizes sending. Selectors are per vendor.
-
3
Publish operator DMARC
Publish DMARC at _dmarc.<from-domain> yourself (at least p=none) for From-domain alignment. Check alignment with free tools, then read reports before enforcing.
-
4
Keep mail hostnames DNS-only
Set every mail-related hostname to DNS-only (grey cloud, not proxied). Proxied mail names create _dc-mx surprises. Leave website A/AAAA and unrelated TXT alone.
Do not touch
What to leave alone
ArawaMail only writes mail-auth rows. Everything else in the zone stays yours — touching it breaks the site, another sender, or Cloudflare features.
Website records
Website A / AAAA and CNAME rows are not mail. Activation does not rewrite them.
Unrelated TXT
Verification TXT, unrelated services, and other vendors stay until you intentionally migrate that stream.
Leftover cf-bounce
While Cloudflare sending is still enabled, rows such as cf-bounce are Cloudflare Email Sending, not ArawaMail. Remove only when retired.
Split-stack SPF includes
An extra vendor SPF include still on apex after moving sending to ArawaMail. See Two vendors, one From address and SPF 10-lookup limit.
Subdomain inheritance
SPF, DKIM, and DMARC do not all inherit the same way. Subdomain mail needs its own review.
Reverse DNS
PTR / FCrDNS belongs to sending-IP owner. Do not add PTR in Cloudflare DNS — read the PTR article.
ArawaMail DNS FAQ
DNS questions operators actually ask.
What does ArawaMail add when I activate receiving?
Activate receiving publishes inbound MX on the Cloudflare zone and routes inbound mail to ArawaMail. Existing MX elsewhere triggers confirmation before replace. Copy exact MX host from Domain details on draft day.
What does ArawaMail add when I activate sending?
Enable sending creates or retrieves outbound identity, adds DKIM CNAMEs, configures custom MAIL FROM domain, and adds MAIL FROM MX and SPF. Both mailbox and API sending require sending-active.
Does ArawaMail publish DMARC, MTA-STS, or TLS-RPT for me?
Not documented. Treat DMARC at _dmarc, MTA-STS, TLS-RPT, BIMI, and PTR as operator-owned unless live product says otherwise. Publish DMARC yourself (at least p=none).
Can I keep Cloudflare Email Routing MX next to ArawaMail MX?
No. Receiving cannot share MX. Email Routing MX next to ArawaMail MX breaks inbound routing. Choose one receiver per domain — see ArawaMail vs Cloudflare Email Service.
Should mail hostnames be proxied through Cloudflare?
No — DNS-only (grey cloud). Mail hostnames must stay DNS-only, not proxied. Proxied mail names produce _dc-mx surprises.
Where do I copy the exact values?
Domain details / activation screen in app.arawamail.com on draft day. Public docs list kinds, not live hostnames. If values cannot be confirmed, link that screen instead of guessing.
What should I leave alone?
Website A/AAAA, unrelated TXT, leftover cf-bounce while Cloudflare sending is still enabled, and other vendor SPF includes until retired. See SPF 10-lookup, DKIM rotation, and Two vendors, one From address.
Next step
Activated? Verify it in under a minute.
Confirm MX, SPF, DKIM, and DMARC after activation — then publish the DMARC you still own before Q4 volume.
Open free email tools