Cloudflare DMARC Management is now GA, and email authentication is free for everyone!

Hi everyone, it's Shii! Today I found some happy news about email security. Cloudflare's DMARC Management has finally reached general availability (GA), and it's now free for every customer! Email authentication tends to get put off, but this is an exciting announcement, so let's take a look together!

Cloudflare Blog blog.cloudflare.com

What was announced?

This news came from Cloudflare's Blog (dated June 16, 2026). DMARC Management, a feature that lets you manage email authentication all in one place, has reached its general availability version and is now open to all Cloudflare customers at no additional cost.

Here's the principle Cloudflare gives for offering it for free:

every domain on the Internet deserves strong email authentication, and cost should never be the reason it doesn't happen

Since this is a Blog announcement (more of a News or Changelog style notice), it reads less like a deep technical walkthrough and more like a "now everyone can use it!" unveiling.

The story so far

Email authentication rests on four mechanisms: SPF, DKIM, DMARC, and BIMI. Roughly speaking, here's how they split the work:

• SPF: decides which IP addresses may send email on behalf of your domain
• DKIM: applies a cryptographic signature to email so you can detect tampering
• DMARC: ties SPF and DKIM together and tells servers how to handle mail that fails authentication
• BIMI: when DMARC is robust enough, it can display your brand logo in supported inboxes

But honestly, setting this up used to be quite a chore. DMARC in particular asks you to read the authentication reports that receiving servers send back and gradually tighten your policy, yet those reports are meant for machines and are hard for people to read, and telling legitimate senders apart from spoofers was a struggle.

DMARC policies come in stages:

• p=none: monitoring mode, watches without blocking
• p=quarantine: routes suspicious mail to the spam folder
• p=reject: blocks mail that can't be authenticated entirely

Reaching that p=reject (full enforcement) with confidence was where everyone got stuck.

What changes

Now that DMARC Management is GA, you can walk this once-tedious path from a single Cloudflare dashboard. There's no extra charge and almost no configuration needed, so as long as your DNS is on Cloudflare, you can start right away.

The nice part is that you no longer have to give up on email authentication because of cost. Even small domains can properly step up to the starting line for anti-spoofing, and I think that's a quiet but really important change.

Dive Deep

Let me highlight the three things this GA release especially strengthened.

1. Better report visibility On top of the existing reports, source IP addresses now appear alongside service names. You can dig straight into an IP that catches your eye and check Cloudflare's threat intelligence (reputation data, geolocation, ASN details, and more). It's much easier to trace where a message came from.

2. Record status analysis For your DMARC, DKIM, SPF, and BIMI records, you can now see their pass, warning, or fail status together in one dashboard. On top of that, for common issues like malformed keys or missing mechanisms, it gives you plain-language recommendations on how to fix them.

3. SPF lookup audit SPF has a limit set by RFC 7208: a hard limit of 10 DNS lookups per SPF evaluation. Chain together too many includes and you hit that ceiling, and SPF stops working properly. The new audit tool helps you find expensive include chains and consolidate where you can.

Getting started is simple:

1. Host your domain's DNS on Cloudflare
2. Open DMARC Management from the Email menu in the dashboard
3. Complete the setup wizard
4. Review the record analysis and recommendations
5. Progress toward stricter enforcement policies

Wrap-up

• Cloudflare DMARC Management is now GA and free for every Cloudflare DNS customer
• Manage SPF, DKIM, DMARC, and BIMI in one place, and tighten step by step from p=none to p=reject
• Reports now include source IPs and threat intelligence, making spoofing investigations easier
• New additions include pass, warning, and fail record status with fix recommendations, plus an audit tool for SPF's 10-lookup limit
• If your DNS is on Cloudflare, you can start from the dashboard with almost no configuration

I think this lands especially well for anyone who's been putting off email authentication, or small teams wanting to take that first anti-spoofing step. If you can get this much set up for free, it's well worth peeking at your dashboard next week!