Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If Cloudflare Email Routing suddenly stops forwarding mail, verify your domain’s authoritative nameservers at the registrar before changing any Email Routing setting. When the registrar no longer delegates the domain to Cloudflare, the records shown in the Cloudflare dashboard are not authoritative. If delegation is correct, check MX records, SPF/TXT records, and proxy status in that order.
What a nameserver change has to do with email forwarding
Email Routing depends on Cloudflare DNS answering for your domain. The registrar publishes which nameservers are authoritative; those nameservers, in turn, publish the MX, TXT, and other records that receiving mail servers query. Cloudflare’s general DNS guidance states that if a domain managed in the dashboard stops pointing to Cloudflare’s nameservers, DNS resolution stops functioning.
This can happen after a registrar transfer, a hosting migration, an expired DNS service, or an accidental change from Cloudflare’s assigned nameservers to the registrar’s defaults. In that situation, editing MX records in Cloudflare cannot repair delivery because other DNS resolvers never see those edits.
Email Routing is forwarding, not a conventional mailbox. It accepts mail for addresses on your domain and relays it to a destination address. It does not replace a full mail-hosting service, and its MX records must be the records that control the domain. Running another mail service with a different MX set requires a deliberate migration; leaving both sets in place creates an unpredictable or broken configuration.
#1 Best Overall
Use this diagnostic order
Run the checks from outside the Cloudflare dashboard. A dashboard can show the intended configuration even when public DNS is delegated elsewhere.
- Authoritative nameservers: confirm the registrar delegates the domain to the two Cloudflare-assigned nameservers.
- Public MX records: confirm every returned target and priority matches the records Email Routing expects.
- Email Routing state and managed records: verify the service is enabled and that its automatically managed records exist.
- SPF and other TXT records: make sure there is one valid SPF policy, including Cloudflare’s required include when applicable.
- Proxy status: set any mail hostnames used for SMTP, IMAP, or POP3 to DNS-only.
- Propagation and escalation: allow the documented interval, then provide precise DNS output and error messages to the administrator or provider.
Step 1: Verify delegation at the registrar
Query the nameservers
From a terminal, replace example.com with your domain:
dig example.com NS +shortThe result should list the exact Cloudflare-assigned nameservers shown on your domain’s Overview page. You can also use an independent DNS lookup service to query NS records from outside your network. Compare the public result with the registrar’s Nameservers or DNS delegation screen.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Interpret the result
- Cloudflare nameservers appear: delegation is probably correct; continue to MX inspection.
- Registrar defaults or another provider appear: Cloudflare is not authoritative. Replace the delegation at the registrar with the assigned Cloudflare nameservers, then save the change.
- Different answers appear at different resolvers: a nameserver change is still propagating or the registrar has inconsistent delegation. Recheck after the registrar confirms the update.
Do not change nameservers casually if another application relies on the current DNS provider. Before switching, copy any records that must remain—web hosting, verification TXT records, subdomains, and mail records—and recreate them in Cloudflare. A nameserver change moves authority for the entire DNS zone, not only email.
Step 2: Check the public MX records
Run an MX lookup
dig example.com MX +shortCompare every returned hostname and priority with the Email Routing records listed in Cloudflare. The public answer is what sending mail servers use; the dashboard view alone is not sufficient.
Look for common MX failures
- No MX records: receiving servers may fall back to an A record or reject delivery, so forwarding will not work reliably.
- A typo or stale target: mail is sent to a host that does not accept it.
- Wrong priority: another provider’s MX can be preferred over Cloudflare’s records.
- Two services’ MX sets combined: senders may choose either service, producing intermittent delivery or confusing bounces.
Cloudflare warns that Email Routing’s managed MX records can conflict with another provider’s MX records. One service must control the domain’s MX set. If you are moving to or from a mailbox provider, plan the cutover: lower the existing MX time-to-live in advance where practical, remove the old set at the change window, and verify the new public answer before testing delivery.
Step 3: Confirm Email Routing and its managed DNS records
In the Cloudflare dashboard, open the domain and choose Email (or Email Routing, depending on the current dashboard label). Check that the routing service is enabled, the destination address is verified, and the forwarding rule is active rather than paused or deleted.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Email Service onboarding can add MX records and SPF/DKIM-related records automatically. If those records were deleted, replaced, or placed in a different DNS zone, re-enable the service or use the dashboard’s setup action to recreate the managed records. After saving, query public DNS again; a record visible in the dashboard but absent from dig indicates a delegation, zone, or propagation problem rather than a forwarding-rule problem.
Also check the destination mailbox. A full mailbox, a provider-side block, a disabled alias, or a rule that files forwarded messages into spam can look like a Cloudflare failure. Send a test from an unrelated account and inspect both the destination inbox and its spam or quarantine folders.
Step 4: Fix SPF and TXT-record conflicts
Keep one SPF policy
Cloudflare documents this SPF value for Email Routing:
v=spf1 include:_spf.mx.cloudflare.net ~allSPF permits only one TXT record beginning with v=spf1 for a domain. Publishing two separate SPF records causes a permerror, which can prevent Email Service from working as intended. If another system also sends mail for the domain, merge its authorized sender into the same policy instead of adding a second SPF record. For example, retain Cloudflare’s include and add the other provider’s documented include in the same TXT value, then finish with one policy qualifier.
Distinguish SPF from DKIM and DMARC
SPF authorizes sending infrastructure; it does not by itself prove that forwarding is healthy. DKIM and DMARC records may be required by the service or by your sending provider. Check that TXT records were not accidentally deleted during a DNS migration, and avoid editing Cloudflare-managed values unless the dashboard or provider documentation instructs you to do so. Use:
Rank #4
dig example.com TXT +shortReview the answer for duplicate SPF policies, an old policy left by a previous provider, or a record published under the wrong hostname. TXT lookups can return several unrelated records, so identify the SPF record by its v=spf1 prefix.
Step 5: Make mail hostnames DNS-only
Cloudflare’s standard HTTP proxy carries web traffic, not mail protocols. SMTP, IMAP, and POP3 do not work through the HTTP proxy. Any hostname used as an SMTP, IMAP, or POP3 endpoint must therefore be set to DNS only (the gray-cloud state), not proxied (the orange-cloud state).
In DNS > Records, find the hostname used by the mail service and switch its proxy status to DNS-only. A proxied hostname can resolve to a Cloudflare IP address instead of the actual mail server, causing connection timeouts, TLS errors, or an inability to authenticate. This rule applies to custom mail hosts as well as hostnames used by applications that submit mail through SMTP.
Email Routing’s own MX targets are managed by the service; the proxy check is especially important for any separate hostname you configured for a mail server, submission service, or mailbox provider.
How long DNS changes take
Cloudflare says DNS changes can take up to 24 hours to propagate globally. For domains using Cloudflare DNS, its guidance says updates usually complete within 5–15 minutes, but recursive resolvers can retain older answers until their time-to-live expires. Do not repeatedly edit records during this window; each change can make it harder to identify which version is cached.
Check from more than one network or resolver after the initial wait. Query NS, MX, and TXT records separately, because they can have different TTLs and may update at different times. If the registrar still reports the old delegation after 24 hours, contact the registrar; if delegation is correct but public MX or TXT answers remain wrong, contact the DNS administrator with timestamps and command output.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recognize the symptom from the DNS evidence
| Observed symptom | Likely cause | Evidence to collect |
|---|---|---|
| Cloudflare records look correct, but public DNS shows another provider | Nameservers at the registrar are not Cloudflare’s | dig example.com NS +short and a registrar screenshot |
| Senders receive “no MX” or destination-not-found errors | Missing MX records or an incomplete Email Routing setup | dig example.com MX +short and the exact bounce |
| Some messages arrive and others go elsewhere | MX records from two services are competing | All public MX targets and priorities |
| Forwarding stopped after adding a mail service | Duplicate or replaced SPF/MX records | dig example.com TXT +short and the current MX set |
| SMTP or IMAP connections time out | The mail hostname is orange-cloud proxied | DNS record name and proxy status |
| DNS is correct, but the destination is empty | Unverified, paused, filtered, full, or blocked destination mailbox | Routing rule state and provider-side delivery logs |
When to choose a full mail provider instead
Email Routing suits simple forwarding, such as sending contact@example.com to an existing mailbox. It is not a mailbox, calendar, archive, or complete outbound-mail platform. If you need hosted inboxes, independent sending identities, message retention, user administration, or detailed bounce analytics, a full mail provider may be a better fit.
Recommended Free Tools
| Decision point | Cloudflare Email Routing | Full mail provider |
|---|---|---|
| Authoritative DNS and MX | Requires Cloudflare DNS and Cloudflare-controlled MX records | Requires the provider’s MX records; DNS can remain with another authoritative provider if supported |
| Mailbox model | Forwards to an existing destination; no hosted inbox | Hosts one or more mailboxes and usually provides storage and user controls |
| SPF, DKIM, and DMARC | Cloudflare-managed records may be added during onboarding; keep one SPF policy | Provider supplies its own sending and authentication records |
| Diagnostics | DNS and routing checks plus destination-provider logs | Usually includes provider-side message tracing and bounce details |
| Migration control | Change Cloudflare-managed MX records only when no competing service needs them | Plan MX cutover, TTLs, aliases, and mailbox migration before switching |
Do not publish both providers’ MX records merely to “keep options open.” Decide which service receives mail, document the records, and test from an external sender after the cutover.
What to send when escalating
Support can diagnose a DNS problem much faster when the report contains reproducible evidence. Include:
- The domain and the time zone and timestamp of a failed test.
- The complete bounce or SMTP error, not a paraphrase.
- Output from
dig example.com NS +short,dig example.com MX +short, anddig example.com TXT +short. - The nameservers shown at the registrar and in Cloudflare.
- The Email Routing rule state, destination verification state, and whether managed records are enabled.
- The hostname and proxy status for any SMTP, IMAP, or POP3 endpoint.
Redact message contents and credentials, but do not remove the DNS targets, priorities, error codes, or timestamps. Cloudflare’s troubleshooting pages were updated June 9, 2026, and September 16, 2026; its general DNS issues page was updated April 16, 2026. Those pages emphasize the same order: establish authoritative DNS, then validate mail records and protocol compatibility.
Final verification checklist
- Registrar delegation returns the Cloudflare-assigned nameservers.
- Public MX answers contain only the intended mail service’s targets and priorities.
- Email Routing is enabled, the destination is verified, and the rule is active.
- There is exactly one SPF policy, containing
include:_spf.mx.cloudflare.netwhen Cloudflare Email Service requires it. - DKIM, DMARC, and other required TXT records remain in the authoritative zone.
- Mail hostnames used for SMTP, IMAP, or POP3 are DNS-only.
- At least 5–15 minutes has elapsed for a normal Cloudflare DNS update, and you have allowed up to 24 hours before treating global propagation as complete.
- An external test message reaches the verified destination without a bounce.
If the first item fails, fix delegation before touching Email Routing. If it passes, the MX, SPF/TXT, managed-record, and proxy checks isolate nearly every configuration failure that can make forwarding appear to stop.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
