How do I add a DKIM record in Cloudflare?

To add a DKIM record in Cloudflare, put the setup sheet host in Name and the DKIM text in Content, and leave Proxy status on DNS only.

Cloudflare is the host where an orange cloud can sit on a CNAME. MX and TXT cannot take that cloud. Proxy status (updated April 21, 2026) names the columns Type, Name and Content, and says only A, AAAA and CNAME records can be proxied. The same page says DNS only — the gray cloud — is what to use for email records and for records that only prove you control the name. Manage DNS records (updated May 6, 2026) is the click path: DNS Records, Add record, Type, the fields that type shows, Save. A domain a hosting partner added to Cloudflare is edited at that partner, which that article also says. capturedOn: 2026-11-10.

GET /domains/{id}/setup is the sheet for this zone. Its host is what Name wants. Do not append the domain. On a send from the apex, DKIM's Name is as1._domainkey. A subdomain such as notify.example.com uses the host the sheet prints for that zone, which is longer than the apex label. Content for DKIM is the sheet value, or each value_strings entry when the TXT is split. The key is generated per domain, so this page does not print one.

A tracking CNAME is the row where the toggle matters. It is on the sheet only when tracking is available, and it never blocks verification. Set that CNAME to DNS only. Proxied means resolvers get Cloudflare addresses instead of the tracking host, so clicks never reach the counter.

POST /domains/{id}/verify reports which required rows resolved. GET /domains/{id} is the same sheet with a status on each row. POST /domains is how the name got onto the account before any of these rows existed.

curl -sS -X GET https://api.agentisend.com/domains/9c8f8f0e-3d1a-4d3f-9a1e-2b7c1a0f5e42/setup \
  -H "Authorization: Bearer $AGENTISEND_API_KEY"

200
{
  "commands": {
    "cloudflare": [],
    "gcloud": [],
    "route53": {}
  },
  "deep_link": "example",
  "detected": false,
  "domain": "example",
  "nameservers": [],
  "provider": {
    "dnsConsoleUrl": "example",
    "id": "example",
    "name": "example"
  },
  "provider_hints": {
    "cloudflare": "example",
    "godaddy": "example",
    "namecheap": "example",
    "route53": "example"
  },
  "records": [],
  "zone": "example",
  "zone_file": "example"
}

The other hosts on the DNS provider page do not have this cloud. Record meanings are in Domains and DNS.

Written by the AgentiSend team.