> ## Documentation Index
> Fetch the complete documentation index at: https://docs.migma.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare DNS

> Step-by-step guide to verify your domain using Cloudflare

## Overview

If your domain's DNS is managed on Cloudflare, you have three options for configuring DNS — from easiest to most manual.

***

## Option 1: Sign in to Cloudflare (One-Click)

The fastest option. Migma auto-detects that your domain uses Cloudflare DNS and handles everything for you — no API token needed.

<Steps>
  <Step title="Add Your Domain">
    Go to **Settings → Sending Domains → Add Domain** and enter the domain you want to send from, such as `yourdomain.com` or `mail.yourdomain.com`.
  </Step>

  <Step title="Click Sign in to Cloudflare">
    On the domain detail page, Migma detects Cloudflare DNS and shows a **Sign in to Cloudflare** button. Click it.
  </Step>

  <Step title="Authorize in Cloudflare">
    You're redirected to Cloudflare to authorize Migma. Review the permissions and click **Authorize**.
  </Step>

  <Step title="Done">
    You're redirected back to Migma. All DNS records are configured automatically and your domain begins verification.
  </Step>
</Steps>

<Note>
  **How this works:** Migma uses the Domain Connect protocol to configure DNS. No API token is created or stored — you simply authorize one-time access through Cloudflare's standard OAuth flow.

  **Prerequisite:** Your domain must be hosted on Cloudflare nameservers (not just using Cloudflare as a proxy).
</Note>

***

## Option 2: API Token Setup

If you prefer to use an API token (or the one-click flow isn't available for your setup), you can create a Cloudflare API token that lets Migma manage DNS records.

### Step 1: Add Your Domain to Migma

<Steps>
  <Step title="Open Sending Domains">
    Go to **Settings → Sending Domains** in your Migma dashboard.
  </Step>

  <Step title="Add Your Domain">
    Click **Add Domain** and enter your sending domain, for example `yourdomain.com` or `mail.yourdomain.com`.
  </Step>

  <Step title="View DNS Records">
    Migma displays the DNS records needed. Keep this page open.
  </Step>
</Steps>

### Step 2: Create a Cloudflare API Token

You need to create an API token that allows Migma to add DNS records.

<Steps>
  <Step title="Open Cloudflare API Tokens">
    Go to [dash.cloudflare.com/profile/api-tokens](https://dash.cloudflare.com/profile/api-tokens)
  </Step>

  <Step title="Click Create Token">
    Click the **Create Token** button.
  </Step>

  <Step title="Select Custom Token">
    Scroll down and click **Get started** next to **Create Custom Token**.
  </Step>

  <Step title="Name Your Token">
    Enter a name like `Migma DNS Access`.
  </Step>

  <Step title="Add Zone Read Permission">
    Under **Permissions**, click **Add more** and select:

    * **Zone** → **Zone** → **Read**
  </Step>

  <Step title="Add DNS Edit Permission">
    Click **Add more** again and select:

    * **Zone** → **DNS** → **Edit**
  </Step>

  <Step title="Set Zone Resources">
    Under **Zone Resources**, choose one of:

    | Option                                       | When to Use                                                 |
    | -------------------------------------------- | ----------------------------------------------------------- |
    | **Include → Specific zone → \[your domain]** | You only want Migma to access this one domain               |
    | **Include → All zones**                      | You want Migma to manage DNS for any domain in your account |
  </Step>

  <Step title="Create the Token">
    Click **Continue to summary**, review the permissions, then click **Create Token**.
  </Step>

  <Step title="Copy the Token">
    **Important:** Copy the token immediately. It's only shown once.

    <Warning>
      If you lose the token, you'll need to create a new one.
    </Warning>
  </Step>
</Steps>

### Step 3: Connect Cloudflare to Migma

<Steps>
  <Step title="Return to Migma">
    Go back to **Settings → Sending Domains** and click on your domain.
  </Step>

  <Step title="Click Connect Cloudflare">
    Find the **Cloudflare Integration** section and click **Connect Cloudflare**.
  </Step>

  <Step title="Paste Your API Token">
    Paste the token you copied from Cloudflare.
  </Step>

  <Step title="Confirm Connection">
    Migma validates the token and shows the zones (domains) available.
  </Step>
</Steps>

### Step 4: Auto-Configure DNS

<Steps>
  <Step title="Click Auto-Configure DNS">
    Click the **Auto-configure DNS** button.
  </Step>

  <Step title="Review Records Added">
    Migma adds all required records to Cloudflare:

    * 3 DKIM CNAME records
    * 1 SPF TXT record
    * 1 DMARC TXT record
    * 2 MAIL FROM records (MX + TXT)
  </Step>

  <Step title="Verify Domain">
    Click **Verify Domain**. Verification typically completes within a few minutes.
  </Step>
</Steps>

***

## Option 3: Manual Setup

If you prefer to add DNS records manually in Cloudflare, follow these steps.

<Tip>
  For a provider-neutral walkthrough with screenshots, see [Add DNS Records](/sending-domains/add-dns-records).
</Tip>

### Step 1: Log in to Cloudflare

<Steps>
  <Step title="Go to Cloudflare Dashboard">
    Navigate to [dash.cloudflare.com](https://dash.cloudflare.com)
  </Step>

  <Step title="Select Your Domain">
    Click on the domain you want to configure.
  </Step>

  <Step title="Open DNS Settings">
    Click **DNS** in the left sidebar, then **Records**.
  </Step>
</Steps>

### Step 2: Add DKIM Records

Add 3 CNAME records for DKIM authentication.

<Steps>
  <Step title="Click Add Record">
    Click the **Add record** button.
  </Step>

  <Step title="Configure First DKIM Record">
    | Field        | What to Enter                                                           |
    | ------------ | ----------------------------------------------------------------------- |
    | Type         | Select `CNAME`                                                          |
    | Name         | Copy the first `_domainkey` name from Migma (e.g., `abc123._domainkey`) |
    | Target       | Copy the corresponding value from Migma                                 |
    | Proxy status | Click to set to **DNS only** (gray cloud)                               |
    | TTL          | Leave as `Auto`                                                         |

    Click **Save**.
  </Step>

  <Step title="Add Second DKIM Record">
    Repeat with the second set of values from Migma.
  </Step>

  <Step title="Add Third DKIM Record">
    Repeat with the third set of values from Migma.
  </Step>
</Steps>

<Warning>
  **Proxy status must be "DNS only" (gray cloud)**

  CNAME records for email authentication cannot be proxied through Cloudflare. If the cloud is orange, click it to turn it gray.
</Warning>

### Step 3: Add SPF Record

<Steps>
  <Step title="Check for Existing SPF">
    Look through your existing TXT records for one that starts with `v=spf1`.
  </Step>

  <Step title="Add or Modify SPF">
    **If you don't have an SPF record:**

    Click **Add record** and enter:

    | Field   | What to Enter                      |
    | ------- | ---------------------------------- |
    | Type    | Select `TXT`                       |
    | Name    | Enter `@`                          |
    | Content | `v=spf1 include:spf.migma.ai ~all` |
    | TTL     | Leave as `Auto`                    |

    Click **Save**.

    ***

    **If you already have an SPF record:**

    Click **Edit** on your existing SPF record and add `include:spf.migma.ai` before the `~all`.

    Example:

    ```
    Before: v=spf1 include:_spf.google.com ~all
    After:  v=spf1 include:_spf.google.com include:spf.migma.ai ~all
    ```
  </Step>
</Steps>

### Step 4: Add DMARC Record

<Steps>
  <Step title="Add DMARC TXT Record">
    Click **Add record** and enter:

    | Field   | What to Enter                                       |
    | ------- | --------------------------------------------------- |
    | Type    | Select `TXT`                                        |
    | Name    | Enter `_dmarc`                                      |
    | Content | `v=DMARC1; p=quarantine; rua=mailto:dmarc@migma.ai` |
    | TTL     | Leave as `Auto`                                     |

    Click **Save**.
  </Step>
</Steps>

### Step 5: Add MAIL FROM Records

Add both an MX record and a TXT record for the MAIL FROM subdomain. Copy the Name from Migma. If your sending domain is a subdomain and your Cloudflare zone is the parent domain, the Name may include that prefix, for example `send.mail-eu`.

<Steps>
  <Step title="Add MX Record">
    Click **Add record** and enter:

    | Field       | What to Enter                      |
    | ----------- | ---------------------------------- |
    | Type        | Select `MX`                        |
    | Name        | Copy the MAIL FROM Name from Migma |
    | Mail server | Copy the value from Migma          |
    | Priority    | Enter `10`                         |
    | TTL         | Leave as `Auto`                    |

    Click **Save**.
  </Step>

  <Step title="Add TXT Record for MAIL FROM">
    Click **Add record** and enter:

    | Field   | What to Enter                      |
    | ------- | ---------------------------------- |
    | Type    | Select `TXT`                       |
    | Name    | Copy the MAIL FROM Name from Migma |
    | Content | `v=spf1 include:spf.migma.ai ~all` |
    | TTL     | Leave as `Auto`                    |

    Click **Save**.
  </Step>
</Steps>

### Step 6: Verify in Migma

<Steps>
  <Step title="Return to Migma">
    Go to **Settings → Sending Domains**.
  </Step>

  <Step title="Click Verify Domain">
    Click **Verify** next to your domain.
  </Step>

  <Step title="Wait for Verification">
    Verification typically completes within minutes. DKIM may take up to 72 hours in some cases.
  </Step>
</Steps>

***

## Managing Cloudflare Connection

### Disconnect Cloudflare

To remove the Cloudflare connection:

1. Go to **Settings → Sending Domains**
2. Click on your domain
3. Click **Disconnect Cloudflare**
4. Your DNS records remain in Cloudflare (they're not deleted)

### Delete DNS Records When Removing Domain

When you delete a domain from Migma:

1. If Cloudflare is connected, you'll see an option: **Also delete DNS records from Cloudflare**
2. Check this option to remove all email-related DNS records
3. Leave unchecked to keep the records (useful if migrating to another service)

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Domain not found in your Cloudflare account" icon="magnifying-glass">
    **Possible causes:**

    * Your domain's DNS is not managed on Cloudflare
    * The API token doesn't have access to this zone

    **Solutions:**

    1. **Verify your domain is on Cloudflare:**
       * Log in to Cloudflare dashboard
       * Check if your domain appears in the account
       * Verify the domain status is "Active"

    2. **Check your API token permissions:**
       * Go to Cloudflare → Profile → API Tokens
       * Click "View" on your token to see which zones it can access
       * If using "Specific zone", ensure your domain is included

    3. **Create a new token with correct permissions:**
       * Create a new token with "All zones" to test
       * If that works, the original token was zone-restricted
  </Accordion>

  <Accordion title="Invalid API token" icon="key">
    **Possible causes:**

    * Token was copied incorrectly
    * Token was revoked or expired
    * Token doesn't have required permissions

    **Solutions:**

    1. Create a new token with the correct permissions:
       * Zone → Zone → Read
       * Zone → DNS → Edit

    2. Copy the token immediately after creation (it's only shown once)

    3. In Migma, click **Disconnect Cloudflare** and reconnect with the new token
  </Accordion>

  <Accordion title="DNS records not propagating" icon="clock">
    **What's happening:**
    Cloudflare updates are usually instant, but global DNS propagation takes time.

    **Timeline:**

    * Cloudflare: Instant
    * Global DNS: 5-60 minutes
    * DKIM verification: Up to 72 hours (rare cases)

    **What to do:**

    * Wait at least 15 minutes before retrying verification
    * Use [DNS Checker](https://dnschecker.org) to see if your records have propagated
  </Accordion>

  <Accordion title="Proxy status warning" icon="shield">
    **Issue:**
    CNAME records have orange cloud (proxied) instead of gray cloud (DNS only).

    **Why it matters:**
    Email authentication records cannot be proxied through Cloudflare. They must resolve directly.

    **Solution:**

    1. Go to Cloudflare DNS settings
    2. Find the DKIM CNAME records
    3. Click the orange cloud to turn it gray
  </Accordion>

  <Accordion title="Record already exists" icon="copy">
    **What happens:**
    If a DNS record with the same name and type already exists, Migma updates it instead of creating a duplicate.

    **This is normal and expected.** Your existing record is modified to include the correct values.
  </Accordion>
</AccordionGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Domain Settings" icon="gear" href="/sending-domains/domain-settings">
    Configure open and click tracking
  </Card>

  <Card title="Send to Audience" icon="paper-plane" href="/audience/sending-emails">
    Send your first email campaign
  </Card>
</CardGroup>