By the end of this tutorial, you’ll know how to configure the DNS records Lemlist needs in Cloudflare, including MX, SPF, DKIM, DMARC, and a custom tracking domain. You’ll also know what each record does and how to avoid the most common setup mistakes.

Getting your DNS right is one of the most important parts of email deliverability. A correct setup helps your emails reach inboxes more reliably, protects your domain from spoofing, and enables Lemlist tracking features like opens and clicks.

In Cloudflare, start by going to Domains, open the three-dot menu for the domain you want to use, and click Configure DNS. This takes you to the DNS records area where you can add, edit, or remove records for that domain.

Once you’re on the DNS records page, click Add record whenever you want to create a new DNS entry for Lemlist.

Lemlist relies on several DNS records to verify that your domain is allowed to send email, receive mail correctly, and track engagement safely. When these records are configured properly, you improve deliverability, protect your sender reputation, and make sure your campaigns work as expected.

Your MX record controls incoming email for your domain. This tells other mail servers where to deliver email sent to your addresses.

Common MX examples:

After entering the values, save the record. If you ever need to change it later, you can edit the existing MX record in Cloudflare.

Your SPF record tells receiving servers which tools are allowed to send email on behalf of your domain. Without SPF, your emails are more likely to land in spam or fail authentication checks.

Important: each domain should have only one SPF record. If you use multiple sending tools or providers, combine them into a single SPF TXT record by adding multiple include: statements.

Example SPF formats:

If you use more than one provider, your SPF might look like this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

If you later add another sending tool, edit your existing SPF record instead of creating a second one.

DKIM acts like a digital signature for your emails. It proves that the message really came from your domain and wasn’t altered in transit.

Unlike SPF and DMARC, DKIM values are usually unique to your domain and provider. That means you should always copy them directly from Google, Microsoft, Zoho, or whichever mail platform you use.

DMARC adds another layer of protection by telling receiving servers how to handle messages that fail SPF or DKIM. It also helps you monitor how your domain is being used.

Before you add DMARC, make sure your SPF and DKIM records are already in place.

A common starting value is:

v=DMARC1; p=quarantine; pct=90; sp=none;

About the policy setting:

If you’re just getting started, quarantine is usually the safest choice.

A custom tracking domain makes your links and tracking look aligned with your own domain instead of a generic one. This improves trust, supports deliverability, and enables open and click tracking in Lemlist.

To set this up, you’ll create:

In Lemlist, click your name in the lower-left corner and select Settings.

Then open Sending settings, expand the Email section if needed, and click Settings for the email address you want to configure.

Inside that email’s settings, open the Custom tracking domain section and copy the CNAME values Lemlist shows you, including the Host name and Value.

Back in Cloudflare, click Add record, open the Type dropdown, and select CNAME.

Then paste the Lemlist values into the new record:

This part is very important: the custom tracking domain CNAME should not be proxied through Cloudflare. If proxying stays enabled, the tracking domain may fail validation in Lemlist.

DNS changes can propagate quickly, but they may still take time. In many cases, records appear within 10 to 15 minutes, but propagation can also take up to 48 to 72 hours.

Once the records propagate, Lemlist will validate the tracking domain successfully.

Here’s what a typical Lemlist domain setup in Cloudflare might include:

Root cause: SPF, DKIM, or DMARC is missing or misconfigured.

Root cause: each sending tool was added as a separate SPF record instead of being combined.

Root cause: the CNAME is proxied through Cloudflare or the TXT verification record is incorrect.

Root cause: wrong mail server value or incorrect priority.

Root cause: DNS propagation delay.