Use this guide when Cloudflare is the authoritative DNS provider for your domain and NTS has asked you to update DMARC for email security monitoring.

DMARC is published as a TXT record at the host name _dmarc. Your domain should have only one _dmarc TXT record.

If your domain is listed in Cloudflare but DNS is managed by a hosting partner or another provider, make this change at the authoritative DNS host instead.

Sign in to Cloudflare with a user account that has permission to edit DNS records for the domain.

Official Cloudflare DNS record reference: https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/

Replace the current _dmarc TXT value with the following NTS DMARC record:

v=DMARC1; p=reject; rua=mailto:dmarc@networkthinking.ai; ruf=mailto:dmarc@networkthinking.ai;

Name: _dmarc

Type: TXT

Content: paste the full record exactly as shown above, including the trailing semicolon.

TTL: Auto is acceptable unless NTS has given you a specific value.

Policy: p=reject tells receiving mail systems to reject messages that fail DMARC alignment. Confirm with NTS before applying this policy if you are unsure whether all legitimate email senders are already authenticated.

Cloudflare DNS changes are usually visible quickly, but downstream DNS resolvers may cache older answers until their TTL expires.

After saving, send a screenshot of the _dmarc TXT record to support@networkthinking.com or ask NTS to verify the record publicly.

The final DNS result should show one TXT record for _dmarc.yourdomain.com with this exact value:

v=DMARC1; p=reject; rua=mailto:dmarc@networkthinking.ai; ruf=mailto:dmarc@networkthinking.ai;

If you cannot edit DNS records, ask a Cloudflare account administrator to grant DNS Write access or make the change for you.

If Cloudflare reports a duplicate record, search the DNS Records page again for an existing _dmarc TXT record and edit it instead of adding a new one.

If your domain was added to Cloudflare by a hosting partner, Cloudflare may require DNS record management through that partner instead of the Cloudflare dashboard.

If you use a third-party email platform, marketing platform, CRM, or ticketing system to send mail as your domain, make sure SPF and DKIM are configured for those senders before enforcing p=reject.

For help, email support@networkthinking.com or open /remote-support.