How to authenticate your domain name on Cloudflare

📅 Last updated: June 2026

⏱ 4 min read

✅ All plans

In this guide, you will discover the exact technical procedures required to set up cryptographic authentication for your custom domain name using Cloudflare. Authenticating your records is a critical step in establishing sender legitimacy, bypassing automated spam filters, and maximizing your email marketing deliverability.

Case 1: Routing your campaign sequences through SystemeScale

If you use our native integrated autoresponder platform to deploy broadcasts, follow this detailed staging sequence to map your parameters.

Step 1: Generate your security record keys within SystemeScale

Open your Email Configuration panel

Hover over your main profile avatar image in the top navigation panel and click on Settings. In the left sidebar management layout, click on Emails.

Launch the domain generation wizard

Scroll directly down to the Domains section parameters, then click the tracking link text labeled: "Click here to authenticate your domain and display its information in your email header, which will help improve your email delivery rates".

Input your naked domain string

In the pop-up wizard modal that opens, enter your clean domain name string without the "www" prefix (e.g., test-sio.org). Click Save.

Reveal your unique cryptographic codes

Refresh your browser page window. Locate your target domain entry row and click its accompanying eye-shaped icon. The system will slide open a values index displaying three CNAME records and one TXT record (your mandatory DMARC rule entry). Keep this screen open.

🛑

Crucial DNS Infrastructure Rules

Domain name authentication is mandatory to process email broadcasts through our system servers.
Your custom domain path must resolve to an active, working website. If your target domain throws a 404 server error, major incoming mail servers may systematically block your broadcasts. For example, your site path must resolve correctly; otherwise, email sent from info@test-sio.org will experience severe server blockades.
You cannot authenticate domain paths from consumer email suppliers (e.g., Gmail, Yahoo Mail, ProtonMail). Only private custom domains can be authenticated.

The generated TXT token represents your required email fraud protection policy. To read more about how DMARC works to preserve list reputations, visit our guide: How to create a DMARC record.

Step 2: Map your entries inside your Cloudflare DNS zone dashboard

Now, you must copy these parameters and deploy them safely within your external Cloudflare account.

Access your Cloudflare DNS management area

Log directly into your Cloudflare account panel. Select your target domain, browse into its setting parameters, and click on Records within the primary DNS navigation tab area, then select Add record.

Map the three individual CNAME records

Select the CNAME option from the structural type dropdown selector box. Fill out the fields carefully using the data generated inside your open dashboard workspace:

Name field: Paste the generated Name string. Crucial Rule: Paste only the specific prefix host segment that comes before your root domain name (e.g., if the generated row string reads si942517.test-sio.org, strip your root domain and enter only si942517).
Target / Content field: Paste the full matching target string (e.g., inbound.systeme.io).

⚠️

Mandatory Cloudflare Proxy Adjustment (DNS Only)

You must switch off Cloudflare's default proxy configuration for all three matching CNAME rows. Toggle the status icon from "Proxied" (orange cloud) to "DNS only" (gray cloud icon). Leaving the proxy active masks our authentication server headers, which completely blocks validation checks and destroys deliverability.

Click Save to validate and lock the row block. Repeat this identical field mapping configuration for all three unique CNAME layers, ensuring every single cloud icon is set to gray.

Deploy your required DMARC TXT record row

Initialize another new record inside Cloudflare, setting the structural type selector dropdown menu strictly to TXT. Map the values precisely as follows:

Name: _dmarc
TTL: Auto / default
Content / Value: v=DMARC1; p=none; rua=mailto:yourreportingaddress@domain.com

Click Save to validate your record entry.

Step 3: Verification and final validation steps

After your four structural record nodes have been successfully deployed inside Cloudflare, check that your modifications are correctly broadcasting across the public network layer.

Open a public lookup utility like DNS Checker. Enter your full prefix host string combined with your root domain into the query search line (e.g., si942517.test-sio.org) and select the CNAME record type. If the tool resolves green checkmarks next to your target keys, propagation is processing successfully.

Similarly, query your root domain inside a public DMARC Checker tool to verify that your protection text record is readable. Once these entries show active across the network, you must reach out to our technical support team to finalize validation parameters from our end.

⚡

Final Required Sender Identity Step

To start dispatching outbound campaigns utilizing your newly authenticated domain path, you must complete the sender address verification block. Follow our step-by-step tutorial walkthrough: How to confirm your email sender address.

Case 2: You are utilizing an external custom SendGrid account array

If you route your marketing broadcasts using an independent, external SendGrid API account connection instead of using our native system server autoresponder pools, we recommend reaching out directly to SendGrid's technical support specialists or reviewing documentation inside your SendGrid panel for their custom Cloudflare domain integration paths.

Was this article helpful?

📄Why aren't my emails being sent?→ 📄How to confirm your email sender address→ 📄How to improve the deliverability of my emails (advanced tips)→ 📄Why do my emails arrive in the Gmail 'promotions' tab?→ 📄How to add a DMARC record on Cloudflare→