This article shows you how to add the DNS records from the WithWine Configure DKIM page to a domain managed by Cloudflare. The records let email providers check that WithWine emails sent from your own email address really come from your domain, so the emails are less likely to go to spam.
You add six records in Cloudflare: three DKIM records (type CNAME), two Mail From records (types MX and TXT) and, if your domain doesn't have one yet, one DMARC record (type TXT). Words in square brackets in this article are placeholders, not text to type. [yourdomain] means your own domain: for example, if your From Email Address is orders@mywinery.com.au, your domain is mywinery.com.au. [code] means the long string of random letters and numbers that WithWine shows at the start of each DKIM record. Each of the three DKIM records has a different code. Always copy and paste the real values from your Configure DKIM page, and never type the square brackets. Use the exact values from your Configure DKIM page.
Before you start
Your From Email Address must be verified, and you must have clicked Generate DNS records for [your domain] on the Configure DKIM page. See How to set up DKIM for your email domain.
Check your domain's DNS is managed by Cloudflare. Your domain's nameservers end in ns.cloudflare.com when Cloudflare manages your DNS. If your DNS is managed somewhere else, add the records there instead. See How to find out which company manages your domain's DNS.
Keep the WithWine Configure DKIM page open in one browser tab and Cloudflare open in another, so you can copy and paste each value. Copy and paste rather than typing, because one wrong character stops DKIM working.
How to open your DNS settings in Cloudflare
Log in to the Cloudflare dashboard.
Select your domain.
Go to DNS > Records.
What to type in Cloudflare's Name field
Cloudflare adds your domain to the end of the Name automatically, so enter only the part before your domain. On the Configure DKIM page, the names include your domain. For example:
DKIM record: [code]._domainkey.[yourdomain] on the Configure DKIM page → enter [code]._domainkey in Cloudflare.
Mail From records: withwinemail.[yourdomain] → enter withwinemail.
DMARC record: _dmarc.[yourdomain] → enter _dmarc.
How to add the three DKIM records in Cloudflare
Select Add record.
Set Type to CNAME.
In Name, enter the first DKIM record's name, without your domain (for example [code]._domainkey).
In Target, paste the first DKIM record's value (for example [code].dkim.amazonses.com).
Turn Proxy status off so the record shows DNS only (a grey cloud). DKIM doesn't work if the record is proxied (an orange cloud).
Leave TTL as the default.
Select Save.
Repeat for the second and third DKIM records. You must add all three.
How to add the Mail From records in Cloudflare
The two Mail From records go on the withwinemail sub-domain only (for example withwinemail.[yourdomain]). Don't change the MX or SPF records on your main domain, because those records control your normal email inbox.
MX record:
Select Add record.
Set Type to MX.
In Name, enter withwinemail.
In Mail server, paste feedback-smtp.us-west-2.amazonses.com.
In Priority, enter 10.
Select Save.
TXT record:
Select Add record.
Set Type to TXT.
In Name, enter withwinemail.
In Content, paste v=spf1 include:amazonses.com ~all. If you leave out the quote marks, Cloudflare adds them for you.
Select Save.
How to add a DMARC record in Cloudflare
First check whether your domain already has a DMARC record: look for a TXT record named _dmarc. A domain can only have one DMARC record. If one already exists, don't add another, and ask your IT provider before changing it.
If there's no DMARC record:
Select Add record.
Set Type to TXT.
In Name, enter _dmarc.
In Content, paste v=DMARC1;p=none;sp=none;pct=100;aspf=r;adkim=r;
Select Save.
The example DMARC record on the Configure DKIM page uses p=quarantine. WithWine recommends starting with p=none instead, as the warning on that page explains. After a few weeks with no delivery problems from WithWine or your usual email system, you can change p=none to p=quarantine.
What happens next
Cloudflare DNS changes usually take effect within a few minutes.
Go back to the WithWine Configure DKIM page and click Refresh. When WithWine finds the records, DKIM Configuration and Mail From Configuration change from Pending to Success.
Leave the records in Cloudflare. If the records are deleted, DKIM stops working and your emails are more likely to go to spam.
Troubleshooting
The DKIM status won't change to Success. Check each DKIM CNAME record shows DNS only (grey cloud), not Proxied (orange cloud). Edit the record and turn off Proxy status.
Cloudflare shows an error when saving a CNAME record. Turn off Proxy status so the record is DNS only, then save again.
The status still isn't Success after 48 hours. Check each record in Cloudflare: the type is right, the Name doesn't include your domain twice, the value has no spaces at the start or end, and all three DKIM records exist. Then click Refresh on the Configure DKIM page again.
My normal email stopped working. An MX or TXT record on your main domain may have been changed by mistake. The Mail From records belong on the withwinemail sub-domain only. Put back your main domain's original records, or contact Cloudflare support or your IT provider.