Custom domain email in Gmail, with DNS at Cloudflare

1. Add the domain to mxproxy

1. Create the account (or sign in) and, under Domains, add your domain, for example yourdomain.com.
2. Open the domain: the page shows the DNS records to create. Keep that tab open; you will copy the values from it.

The DKIM key and the code of the _mxproxy TXT are unique to each domain: copy them from the dashboard, not from this guide.

2. Open Cloudflare’s DNS zone

1. In the Cloudflare dashboard, pick the account and the domain.
2. Open DNS › Records.
3. Click Add record, pick the type, fill it in and save. Repeat for each record.

How to fill in the name (host) at Cloudflare

Use @ for the root and only the beginning for the others (_mxproxy, _dmarc, the selector with ._domainkey); Cloudflare adds the domain. The MX has a Priority field.

3. Create the MX, SPF, DKIM and verification records

Create these records in the domain’s zone. The first two are the same for everyone; the last two have values of their own, which you copy from the mxproxy dashboard.

• One SPF only. If the domain already has a TXT starting with v=spf1 (from a host, Google, an online store), do not create another: add include:spf.mxproxy.dev to the existing one, before the ~all or -all. Two SPF records make both fail.
• Delete the old MX records. Email goes to the answering MX with the lowest priority number: a leftover MX can receive part of the messages.
• The whole DKIM. The value is long (it starts with v=DKIM1; k=rsa; p=). Copy it with the dashboard’s button and paste it without line breaks or extra spaces.
• Domain in the name. If the panel adds the domain to the name by itself, type only _mxproxy; if you type _mxproxy.yourdomain.com, the record becomes _mxproxy.yourdomain.com.yourdomain.com.

Optional, but recommended

• MTA-STS: CNAME mta-sts → mta-sts.mxproxy.dev and the two TXT records (_mta-sts and _smtp._tls) the dashboard shows. It makes the servers that send to you require TLS. We host the policy.
• DMARC: TXT _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to start by just watching. The reports arrive by email; the DMARC reader opens the files.

What is different at Cloudflare

• Turn off Cloudflare Email Routing first. If the domain uses Email Routing, it created and locked its own MX, SPF and DKIM at the root, which cannot be edited in DNS › Records. Disable it in Email Routing › Settings › Disable Email Routing (in the current menu, under Compute › Email Service): that removes its records, and then you create mxproxy’s. There is also Unlock, but an unlocked record stays tied to Email Routing and is deleted if you disable it later.
• Grey cloud on mta-sts. MX and TXT are never proxied. The (optional) mta-sts CNAME must be DNS only, grey cloud: proxied, the name resolves to Cloudflare and we cannot issue the policy’s certificate.
• Long TXT. Each record takes up to 4,096 bytes and Cloudflare adds the quotes itself: paste the DKIM as it is.
• Nameservers. The Cloudflare zone only works if the domain’s registrar points to the nameservers Cloudflare gave you.
• Comparing Email Routing with mxproxy? See the comparison.

Cloudflare’s official help

4. Check

Back in the mxproxy dashboard, click Verify now. Each record shows as ok or pending.

Want to check from the outside? Use the free checker, no sign-up:

Your domain Check

Still pending? A DNS change usually takes minutes, but can take a few hours (until the old record’s TTL runs out). Wait and check again.

5. Choose where each address goes

• Catch-all: all email to any address of the domain goes to the inbox you choose (your Gmail, for example). That is what the free plan offers: one domain, one destination, 10 messages a month.
• Forwarders: one address per line (hello@ to you, billing@ to your accountant), with up to 10 destinations each, depending on the plan. From Personal up.

Send an email from another address to hello@yourdomain.com: it should arrive within seconds. The dashboard’s log shows each message.

6. Reply as the domain in Gmail

To reply as hello@yourdomain.com, and not as your personal address, Gmail needs an SMTP server: create a credential in the dashboard (paid plans, from Personal up) and add the address under Send mail as, with server smtp.mxproxy.dev, port 587. The step by step, for Gmail and Outlook, is in Reply from your domain.

If it does not work

• MX pending: check that no old MX is left and that the name is the root (@ or blank, depending on the panel), not mx or www.
• SPF pending: is there only one v=spf1 TXT, and does it contain include:spf.mxproxy.dev?
• DKIM pending: the name is exactly the dashboard’s (with ._domainkey) and the value was pasted whole.
• Nothing changes: where the domain is registered, look at its DNS servers (nameservers). If they are not Cloudflare’s, the changes have to be made at the company of those servers.

Still stuck? Write to contato@mxproxy.dev.