Cloudflare can be the authoritative DNS provider while a separate mail service receives messages. MX records stay DNS-only and must match the mail service exactly. This guide uses a Free Domain Mail catch-all inbox as the example.
Confirm Cloudflare is authoritative
Compare the domain's public NS answers with the nameservers shown in Cloudflare. If they differ, edit the authoritative provider instead.
Open DNS > Records and note the existing MX set before making a change.
MX and TXT records for a catch-all inbox
Free Domain Mail receives mail for every address at a domain you own — a catch-all inbox with nothing to create per address and messages kept for 30 days. It is receive-only and never sends or forwards mail.
It needs one MX record at @ pointing to mx.freedomainmail.com with priority 10, and one TXT record with Name _maildock-verify holding the maildock-verify=… value shown in the app. The app shows the exact host and value: at providers that append the domain automatically, enter only _maildock-verify; at providers that want the full name, use _maildock-verify.yourdomain.com.
Type Name / Host Value Priority
TXT _maildock-verify maildock-verify=… (shown in the app) —
MX @ mx.freedomainmail.com 10Turn off Email Routing, then add the MX value
The MX records decide where all incoming mail for the domain goes. If the domain already receives mail you depend on, such as a work mailbox, connect a different domain instead. If Cloudflare Email Routing is enabled for the domain, it manages the domain's MX records, and turning it off stops the forwarding it was doing. Disable it for that domain before adding a different mail service's MX record.
Choose MX, use @ for the zone apex, enter the full mail-server target and the priority in its own field. Cloudflare does not proxy MX records. Remove MX records that belong to other services; senders can deliver to any host in the set.
Validate the change
Run MX Lookup from outside Cloudflare and wait for the previous TTL where answers differ. The result should list only the intended host.
Send a message from an external account to a new name at the domain and confirm it arrives. SPF, DKIM and DMARC are only needed if this domain also sends mail through another provider; validate them for that provider separately.
Common mistakes to avoid
- Adding the domain twice in the Name field.
- Leaving old MX records next to the new target.
- Leaving Cloudflare Email Routing enabled while pointing MX at another service.
Frequently asked questions
Should the cloud icon be orange?
No. Email DNS records are not proxied through Cloudflare's HTTP proxy.
Can Cloudflare MX coexist with website records?
Yes. A/AAAA/CNAME website records and email MX/TXT records serve separate protocols.
What priority should the MX record use?
Use the priority your mail service gives you. For Free Domain Mail it is 10 on a single MX record pointing to mx.freedomainmail.com.