{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "item": { "id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "slug": "keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy", "url": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/" }, "title": "Keep the Cloudflare mail-server address path separate from the web proxy", "summary": "An MX target needs the correct mail host address, not a website proxy endpoint.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:17:01+00:00", "modified_at": "2026-10-20T18:34:37+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 257, "potentially_affected": "This concerns DNS for mail services using Cloudflare authoritative DNS.", "dse_recommendation": "DSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status.", "primary_source": { "name": "Cloudflare — Set up email records", "url": "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An MX target needs the correct mail host address, not a website proxy endpoint.

\n

Source facts

\n

Cloudflare’s mail setup guide pairs an MX record with an A or AAAA address for the mail subdomain and shows that address as DNS-only. It states that ordinary Cloudflare service does not proxy SMTP on port 25. The exact records must come from the mail provider; receiving mail, sending mail, and email-authentication records serve different purposes.

\n

Source: Cloudflare — Set up email records.

\n

Applicability

\n

This concerns DNS for mail services using Cloudflare authoritative DNS.

\n

DSE recommendation

\n

DSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status. Keep ordinary mail transports on the provider-supported DNS-only path and review webmail separately as a web service. Preserve SPF, DKIM, and DMARC during a website migration. Do not repoint mail to the website’s address solely because both services share a domain or because the homepage works through Cloudflare. Keep the MX target, its resolved address, and its approved proxy status together in the mail inventory. Have the messaging owner approve them during a website DNS migration. Test the actual delivery path independently from webmail so success of one service cannot hide a broken transport hostname.

\n

Verification

\n

Query the domain’s MX and each target’s address records, then compare them with the mail provider’s instructions. Perform authorized inbound and outbound delivery tests and inspect server evidence separately from DNS. Verify the client-facing TLS hostname and avoid reporting delivery success from a DNS lookup alone.

\n

Official reference

\n

Cloudflare — Set up email records. Reviewed October 20, 2026.

", "content_text": "An MX target needs the correct mail host address, not a website proxy endpoint.\nSource facts\nCloudflare’s mail setup guide pairs an MX record with an A or AAAA address for the mail subdomain and shows that address as DNS-only. It states that ordinary Cloudflare service does not proxy SMTP on port 25. The exact records must come from the mail provider; receiving mail, sending mail, and email-authentication records serve different purposes.\nSource: Cloudflare — Set up email records.\nApplicability\nThis concerns DNS for mail services using Cloudflare authoritative DNS.\nDSE recommendation\nDSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status. Keep ordinary mail transports on the provider-supported DNS-only path and review webmail separately as a web service. Preserve SPF, DKIM, and DMARC during a website migration. Do not repoint mail to the website’s address solely because both services share a domain or because the homepage works through Cloudflare. Keep the MX target, its resolved address, and its approved proxy status together in the mail inventory. Have the messaging owner approve them during a website DNS migration. Test the actual delivery path independently from webmail so success of one service cannot hide a broken transport hostname.\nVerification\nQuery the domain’s MX and each target’s address records, then compare them with the mail provider’s instructions. Perform authorized inbound and outbound delivery tests and inspect server evidence separately from DNS. Verify the client-facing TLS hostname and avoid reporting delivery success from a DNS lookup alone.\nOfficial reference\nCloudflare — Set up email records. Reviewed October 20, 2026.", "content_markdown": "An MX target needs the correct mail host address, not a website proxy endpoint.\n\n## Source facts\n\nCloudflare’s mail setup guide pairs an MX record with an A or AAAA address for the mail subdomain and shows that address as DNS-only. It states that ordinary Cloudflare service does not proxy SMTP on port 25. The exact records must come from the mail provider; receiving mail, sending mail, and email-authentication records serve different purposes.\n\nSource: [Cloudflare — Set up email records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/).\n\n## Applicability\n\nThis concerns DNS for mail services using Cloudflare authoritative DNS.\n\n## DSE recommendation\n\nDSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status. Keep ordinary mail transports on the provider-supported DNS-only path and review webmail separately as a web service. Preserve SPF, DKIM, and DMARC during a website migration. Do not repoint mail to the website’s address solely because both services share a domain or because the homepage works through Cloudflare. Keep the MX target, its resolved address, and its approved proxy status together in the mail inventory. Have the messaging owner approve them during a website DNS migration. Test the actual delivery path independently from webmail so success of one service cannot hide a broken transport hostname.\n\n## Verification\n\nQuery the domain’s MX and each target’s address records, then compare them with the mail provider’s instructions. Perform authorized inbound and outbound delivery tests and inspect server evidence separately from DNS. Verify the client-facing TLS hostname and avoid reporting delivery success from a DNS lookup alone.\n\n## Official reference\n\n[Cloudflare — Set up email records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "url": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep the Cloudflare mail-server address path separate from the web proxy", "item": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/#article", "identifier": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "url": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/", "headline": "Keep the Cloudflare mail-server address path separate from the web proxy", "description": "An MX target needs the correct mail host address, not a website proxy endpoint.", "abstract": "An MX target needs the correct mail host address, not a website proxy endpoint.", "articleBody": "An MX target needs the correct mail host address, not a website proxy endpoint.\nSource facts\nCloudflare’s mail setup guide pairs an MX record with an A or AAAA address for the mail subdomain and shows that address as DNS-only. It states that ordinary Cloudflare service does not proxy SMTP on port 25. The exact records must come from the mail provider; receiving mail, sending mail, and email-authentication records serve different purposes.\nSource: Cloudflare — Set up email records.\nApplicability\nThis concerns DNS for mail services using Cloudflare authoritative DNS.\nDSE recommendation\nDSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status. Keep ordinary mail transports on the provider-supported DNS-only path and review webmail separately as a web service. Preserve SPF, DKIM, and DMARC during a website migration. Do not repoint mail to the website’s address solely because both services share a domain or because the homepage works through Cloudflare. Keep the MX target, its resolved address, and its approved proxy status together in the mail inventory. Have the messaging owner approve them during a website DNS migration. Test the actual delivery path independently from webmail so success of one service cannot hide a broken transport hostname.\nVerification\nQuery the domain’s MX and each target’s address records, then compare them with the mail provider’s instructions. Perform authorized inbound and outbound delivery tests and inspect server evidence separately from DNS. Verify the client-facing TLS hostname and avoid reporting delivery success from a DNS lookup alone.\nOfficial reference\nCloudflare — Set up email records. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:17:01+00:00", "dateModified": "2026-10-20T18:34:37+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep the Cloudflare mail-server address path separate from the web proxy" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 257, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Set up email records", "url": "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/" } } ] } }