# Keep the Cloudflare mail-server address path separate from the web proxy

> An MX target needs the correct mail host address, not a website proxy endpoint.

- Canonical URL: https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:17:01+00:00
- Modified: 2026-10-20T18:34:37+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An MX target needs the correct mail host address, not a website proxy endpoint.

## Potentially affected

This concerns DNS for mail services using Cloudflare authoritative DNS.

## DSE recommendation

DSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status.

## Article

An MX target needs the correct mail host address, not a website proxy endpoint.

## Source facts

Cloudflare’s mail setup guide pairs an MX record with an A or AAAA address for the mail subdomain and shows that address as DNS-only. It states that ordinary Cloudflare service does not proxy SMTP on port 25. The exact records must come from the mail provider; receiving mail, sending mail, and email-authentication records serve different purposes.

Source: [Cloudflare — Set up email records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/).

## Applicability

This concerns DNS for mail services using Cloudflare authoritative DNS.

## DSE recommendation

DSE recommends identifying every hostname used by MX, submission, IMAP, and webmail before changing proxy status. Keep ordinary mail transports on the provider-supported DNS-only path and review webmail separately as a web service. Preserve SPF, DKIM, and DMARC during a website migration. Do not repoint mail to the website’s address solely because both services share a domain or because the homepage works through Cloudflare. Keep the MX target, its resolved address, and its approved proxy status together in the mail inventory. Have the messaging owner approve them during a website DNS migration. Test the actual delivery path independently from webmail so success of one service cannot hide a broken transport hostname.

## Verification

Query the domain’s MX and each target’s address records, then compare them with the mail provider’s instructions. Perform authorized inbound and outbound delivery tests and inspect server evidence separately from DNS. Verify the client-facing TLS hostname and avoid reporting delivery success from a DNS lookup alone.

## Official reference

[Cloudflare — Set up email records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Set up email records
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep the Cloudflare mail-server address path separate from the web proxy,” DSE Security, https://update.dsesecurity.com/updates/keep-the-cloudflare-mail-server-address-path-separate-from-the-web-proxy/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.