If Cloudflare Email Routing suddenly stops forwarding mail, verify your domain’s authoritative nameservers at the registrar before changing any Email Routing setting. When the registrar delegates the domain to nameservers other than the Cloudflare-assigned pair, the records shown in Cloudflare are not authoritative and DNS resolution can fail. If delegation is correct, work through MX records, Email Routing’s managed-record status, SPF/TXT data, proxy mode and DNS propagation in that order.
Start with the nameserver check
Email Routing depends on Cloudflare answering DNS queries for your domain. Cloudflare’s General DNS issues documentation (updated April 16, 2026) states that if a domain managed in the Cloudflare dashboard stops pointing to Cloudflare’s nameservers, DNS resolution will stop functioning. That makes registrar delegation the highest-value first check: a perfectly configured forwarding rule cannot work when the public DNS system is asking another provider for the answer.
As an Amazon Associate I earn from qualifying purchases.
Do this from a terminal, replacing example.com with your domain:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
dig example.com NS +shortThe response should show the two Cloudflare-assigned authoritative nameservers displayed on your Cloudflare Overview page. Nameserver hostnames are unique to the zone, so compare the complete values, including their spelling and ending dot where shown. You can also query a public DNS lookup service from a network outside your office; the important result is the authoritative NS set, not the recursive resolver listed in the output.
#1 Best Overall
What a mismatch means
If the registrar shows its default nameservers, an old hosting company’s nameservers or a different DNS provider’s nameservers, Cloudflare’s DNS records are only local configuration and are not published. Correct the nameservers at the registrar, save the change, and wait for delegation to update. Do not delete and recreate Email Routing while delegation is wrong; that changes records in a zone the internet is not using.
Check MX records after delegation is correct
Mail delivery is controlled by MX (Mail Exchanger) records. Query the public answer:
dig example.com MX +shortCompare every returned hostname and priority with the MX records shown in Cloudflare’s DNS or Email Routing screens. A missing target, a typo, an unexpected priority or an MX record belonging to another mail service can send messages somewhere other than Email Routing. The check must use the public response because the records visible in an account are not proof that the authoritative DNS servers are returning them.
Cloudflare warns that Email Routing’s managed MX records can conflict with records for another provider. One service must control the domain’s MX set. If you are migrating, remove obsolete MX entries only after the replacement service is ready and you have recorded the old values for rollback. Leaving two unrelated mail systems in the same MX set can produce inconsistent delivery: some senders may try one service while others try another according to priority and fallback behavior.
Useful DNS checks in one table
| What to inspect | Command | Result to compare |
|---|---|---|
| Authoritative delegation | dig example.com NS +short |
The returned nameservers match the pair assigned in Cloudflare. |
| Mail exchangers | dig example.com MX +short |
Every target and priority matches the active Email Routing records. |
| SPF and other TXT data | dig example.com TXT +short |
There is one valid SPF policy and any required verification or DKIM records are present. |
| Individual mail host address | dig mail.example.com A +short |
A mail endpoint resolves to its origin address rather than a Cloudflare proxy address. |
Confirm Email Routing is enabled and its managed records exist
In the Cloudflare dashboard, open the zone and choose Email then Email Routing. Confirm that the feature is enabled, the destination address is verified, and the route is active rather than paused or deleted. Check each route if you have several aliases; a single disabled route can look like a domain-wide outage to the person using that address.
Cloudflare’s Email Service documentation says onboarding Email Routing requires Cloudflare DNS and can add MX records plus SPF- and DKIM-related records automatically. Look in the DNS records list for entries marked as managed by Email Routing. If those records are absent, incomplete or duplicated by manually created entries, use the Email Routing setup flow to repair them instead of guessing values. Take a screenshot or export the current records before making changes so you can identify what changed.
A route can be configured correctly while the destination mailbox rejects the message. Verify that the destination address is still accessible, has storage available and has not placed the forwarding sender on a block list. A verification email that never arrives is itself a useful symptom: first prove the MX answer, then inspect the destination mailbox’s spam, quarantine and rejection logs.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Inspect SPF and TXT records
Run:
dig example.com TXT +shortCloudflare documents this SPF value for Email Routing: v=spf1 include:_spf.mx.cloudflare.net ~all. SPF is a single policy record per domain. Multiple separate TXT strings beginning with v=spf1 are not valid as independent SPF policies and can cause Email Service to fail. If another service must send mail for the same domain, merge its authorized mechanisms into one policy rather than publishing a second SPF record. Do not copy an SPF value blindly from an old provider; remove mechanisms for services you no longer use.
TXT output also contains ownership-verification, DKIM and DMARC data when those features are configured. A missing TXT record can affect sending authentication without explaining an MX failure, so separate inbound and outbound symptoms. Email Routing is primarily a forwarding service; SPF, DKIM and DMARC policies still need to reflect every system that sends as your domain. Keep the policy within the provider’s documented limits and test after each change.
Make mail hostnames DNS-only
Any hostname used directly by SMTP, IMAP or POP3 must bypass Cloudflare’s HTTP proxy. Cloudflare’s troubleshooting documentation states that those mail protocols do not work through the standard HTTP proxy. In the DNS records list, select the cloud icon for a mail endpoint and set it to DNS only. A gray cloud means DNS-only; an orange cloud means proxied.
This matters when a domain uses a custom hostname such as mail.example.com for a mailbox provider. Query its address and compare it with the provider’s documented endpoint. If it resolves to a Cloudflare IP instead of the provider’s mail server, clients may time out, fail TLS negotiation or connect to a web proxy that does not understand SMTP, IMAP or POP3. Leave ordinary web records proxied if desired; change only hostnames that carry mail protocols.
Allow for DNS propagation, then test from outside your network
Cloudflare says DNS changes can take up to 24 hours to propagate globally. For domains using Cloudflare DNS, changes usually appear within 5–15 minutes, but resolver caches and registrar delegation can make the interval longer. A result from your office resolver may remain cached after another network has updated, so test with mobile data or a public resolver as well as your normal connection.
- After correcting nameservers or records, wait at least 5–15 minutes and rerun the NS, MX and TXT queries.
- Send a test message from an unrelated mail service to the routed address. Using a different sender helps distinguish a sender-side cache or block from a domain-wide issue.
- Check the destination inbox, spam folder and any quarantine or forwarding logs.
- Inspect the sender’s bounce message. Record the SMTP status code, enhanced status code, receiving hostname and timestamp.
- Repeat the test after the public DNS answers show the corrected values. Do not interpret a local cached answer as proof that the correction failed.
Troubleshoot by the symptom you see
No messages arrive at any routed address
Start with the NS query. A delegation mismatch explains why all aliases fail at once. If NS values are correct, inspect the complete MX response and compare priorities. An empty MX response, an MX target that no longer exists or a target belonging to a former provider points to DNS rather than a route rule. Only after MX is correct should you investigate destination mailbox filtering and route status.
One alias fails while others work
The domain-level DNS configuration is probably reachable, so open Email Routing and inspect that individual route. Confirm the alias spelling, destination verification and enabled state. Check whether the destination mailbox has a rule that rejects or silently files that particular address. Send a message to a known-working alias and the failing alias from the same sender; the comparison narrows the fault to route configuration or destination handling.
Mail works intermittently
Intermittent delivery often follows competing MX records or a migration in progress. Compare all MX targets and priorities, not just the first line. If two providers are listed, different sending servers can select different targets. Keep one authoritative MX design, wait for caches to expire, and repeat tests from multiple networks. A route that works only after several minutes can also reflect propagation rather than a forwarding-rule change.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
The sender receives a bounce mentioning DNS
Preserve the complete bounce before changing anything. Errors such as “no MX,” “host not found” or “temporary DNS failure” direct attention to NS and MX resolution. Query the exact domain named in the bounce; it may be a subdomain rather than the root domain you edited. A refusal from the destination host, by contrast, means DNS reached a mail server and the next investigation belongs with the destination provider or mailbox policy.
Forwarding works, but sending as the domain fails
Inbound forwarding and outbound authentication are separate paths. Review the single SPF record, DKIM configuration and DMARC policy for the system that sends outbound messages. An MX correction will not repair an SPF or DKIM alignment failure. Keep the forwarding destination and the sending service documented separately so a later DNS change does not remove an authorization mechanism still in use.
Understand what Email Routing does—and does not do
Email Routing forwards messages addressed to your domain to another mailbox; it is not the same as hosting a full mailbox with independent storage, folders, calendars and a native send-from-address service. The forwarding path relies on DNS MX records and a verified destination. A full mail provider may instead host the mailbox and require its own MX, SPF, DKIM and DMARC records. Mixing both designs without a migration plan is a common source of conflicting MX data.
Before moving to another provider, decide who should control authoritative DNS and MX records, whether you need forwarding or mailbox hosting, how SPF/DKIM/DMARC will be maintained, what bounce diagnostics and support you require, and how you will stage propagation. Cloudflare specifically cautions that its managed MX records can conflict with another provider’s records. Plan a single cutover, lower DNS TTLs only where appropriate, and keep a tested rollback record set.
What to give support when the checks pass but delivery still fails
Escalation is faster when it includes evidence rather than a description such as “email stopped.” Provide:
- The domain and the exact routed address, with the destination address redacted where necessary.
- The current authoritative NS output from
dig example.com NS +short. - The complete MX output, including priorities and all targets.
- The TXT output relevant to SPF, DKIM and verification, with secrets removed.
- The Email Routing route status and the time it was last changed.
- The full bounce text or SMTP error, sender domain and UTC timestamp.
- Whether the test was made from more than one network and whether any messages reached spam or quarantine.
Cloudflare’s troubleshooting pages were updated June 9, 2026 and September 16, 2026; its General DNS issues page was updated April 16, 2026. Those documents are useful references when discussing the result with a mail administrator, but the live NS, MX and TXT responses are the decisive evidence for your domain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
