Title: Hetzner Email, Cloudflare DNS: The Ultimate Setup Guide
Author: Immanuel Raj
Published: December 5, 2025

---

![](https://immanuelraj.dev/wp-content/uploads/2025/12/hetzner-email-hosting-with-
cloudflare-scaled.avif)

# Hetzner Email, Cloudflare DNS: The Ultimate Setup Guide

[December 5, 2025](https://immanuelraj.dev/hetzner-mail-cloudflare-dns-setup/)

—

by

[Immanuel Raj](https://immanuelraj.dev/author/iamimmanuelraj/)

in [Email](https://immanuelraj.dev/category/email/), [Hosting](https://immanuelraj.dev/category/hosting/)

Read Time

2–3 minutes

Using Hetzner Web Hosting for its rock-solid reliability but managing your DNS through
an external provider like Cloudflare for speed and features? You’re not alone! The
trickiest part is ensuring your external DNS records—especially the MX, SRV, and
TXT records—are perfectly matched to what Hetzner requires.

This guide walks you through configuring your external DNS to keep your email running
seamlessly through your Hetzner Webhosting package.

## 1. Important Note on Cloudflare Proxying

When setting up email records in Cloudflare, you **must** ensure the proxy status(
the orange cloud icon) is set to **DNS Only (Grey Cloud)**. Email traffic cannot
be proxied through Cloudflare’s network, or it will fail.

## 2. Setting the Mail Exchange (MX Record)

The MX record tells the internet where to send mail destined for your domain (`**
_immanuelraj.dev_**` in this example). You should only have this single MX record
for Hetzner to ensure all mail is routed correctly.

| Type | Name | Content (Mail Server) | Priority | TTL | Proxy Status | 
| MX | `@` | www428.your-server.de | 10 | Automatic | DNS Only (Grey) |

## 3. Configuring Auto-Discovery (SRV Records)

SRV (Service) records allow modern email clients (like Outlook or Thunderbird) to
automatically detect the necessary server settings (IMAP, POP3, SMTP ports) when
you simply type in your email address

These records generally point to `**mail.your-server.de**` and must be entered precisely.
When creating these records in Cloudflare, you will typically use the “SRV” type
and fill out five separate fields: Service, Protocol, Name, Target, and Priority/
Weight/Port.

| Service | Protocol | Name | Priority | Weight | Port | Target | 
| _autodiscover | _tcp | @ | 0 | 100 | 443 | mail.your-server.de | 
| _imaps | _tcp | @ | 0 | 100 | 993 | mail.your-server.de | 
| _pop3s | _tcp | @ | 0 | 0 | 995 | mail.your-server.de | 
| _submission | _tcp | @ | 0 | 100 | 587 | mail.your-server.de | 
| _imap | _tcp | @ | 0 | 100 | 143 | mail.your-server.de |

## 4. Setting Up Email Security (TXT Records)

These three TXT records are critical for email deliverability. They prevent spam
and domain spoofing by verifying that emails coming from your domain are legitimate.

### 4.1. Sender Policy Framework (SPF)

This record specifies which servers (Hetzner’s in this case) are allowed to send
mail for your domain.

| Type | Name | Content (Value) | 
| TXT | @ | “v=spf1 +a +mx ?all” |

### 4.2. DomainKeys Identified Mail (DKIM)

DKIM uses a cryptographic key to sign your emails, proving they haven’t been tampered
with. This long key must be copied exactly as provided by Hetzner. Note that the
long string may be displayed in quotes and concatenated (joined together) in your
DNS manager.

| Type | Name | Content (Value) | 
| TXT | default2504._domainkey | “v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx2OjmPDfajT3a+N1Wm6YM” “G3oeL0wpNhqMG4q7xMzxKtC9xmQp49yTVZ99T5bXn0DoUDYF1vyx2UI3fg5oCOB1bVMrrGB8VbXX” “phDohnKwPlxiB8ItFfdxUyLcGhMiw4IznpV2iJBGxZLb0lH6ClJyWRkElhz41rfcLCpykkuJ6mfa” “AtlcglfpJxxSr+Bw+T/nXc1/LGMMK6Ghg9SBSN6Vu20s9w7nL0/ncKxlCurPI8B9V9DzD+IAT+bn” “ztxm20wbkKrCWvVg3XMjWOMbPxVV76+xaEYA4edWhX/0E8ot/2cYXptd9l2ZPvy7zc/9hoSAoz/U” “zi+J2q214fK/p6ecQIDAQAB” |

### 4.3. Domain-based Message Authentication (DMARC)

DMARC tells receiving mail servers what to do if an email fails the SPF or DKIM 
checks. The `p=reject` policy in your record is a strong policy that tells servers
to reject suspicious emails.

| Type | Name | Content (Value) | 
| TXT | _dmarc | “v=DMARC1;p=reject;sp=none;pct=50;adkim=r;aspf=r;” |

## 5. Final Step: Propagation and Testing

Once you’ve entered all nine records (1 MX, 5 SRV, 3 TXT) into your Cloudflare DNS
manager and ensured they are all set to **DNS Only**, you need to wait for DNS propagation.
This usually takes minutes but can sometimes take up to an hour or two.

You can verify your setup using an online tool like [mxtoolbox.com](https://mxtoolbox.com)
to check the MX and SPF records. Once those pass, your Hetzner email should be fully
functional using your high-speed external DNS!

[email](https://immanuelraj.dev/tags/email/) [hosting](https://immanuelraj.dev/tags/hosting/)

[Previous:  Migrating from Frappe v15 to Frappe v16 — A Complete, In‑Place Upgrade Guide](https://immanuelraj.dev/frappe-v15-to-v16-beta-migration-guide/)

[Next:  The Ultimate Guide to Globalping: Test Your Website from Anywhere](https://immanuelraj.dev/globalping-guide/)

![Immanuel Raj Avatar](https://secure.gravatar.com/avatar/88db6e1fa27cf854075acbaa156189ace30cf3701b2d8640cd774280ead1d4d3?
s=80&d=mm&r=g)

## About the author

Software Developer & Technology Consultant

---

## Popular Categories

 * [Bible](https://immanuelraj.dev/category/bible/) (1)
 * [Cloudflare](https://immanuelraj.dev/category/cloudflare/) (1)
 * [Databases](https://immanuelraj.dev/category/databases/) (1)
 * [Docker](https://immanuelraj.dev/category/docker/) (1)
 * [Email](https://immanuelraj.dev/category/email/) (1)
 * [ERPNext](https://immanuelraj.dev/category/erpnext/) (3)
 * [Frappe](https://immanuelraj.dev/category/frappe/) (2)
 * [Github Actins](https://immanuelraj.dev/category/github-actins/) (1)
 * [God](https://immanuelraj.dev/category/god/) (1)
 * [Google Cloud](https://immanuelraj.dev/category/gcp/) (1)
 * [Hosting](https://immanuelraj.dev/category/hosting/) (2)
 * [Life](https://immanuelraj.dev/category/life/) (1)
 * [Linux](https://immanuelraj.dev/category/linux/) (13)
 * [ML](https://immanuelraj.dev/category/ml/) (1)
 * [Networking](https://immanuelraj.dev/category/networking/) (2)
 * [Security](https://immanuelraj.dev/category/security/) (2)
 * [Self Hosting](https://immanuelraj.dev/category/self-hosting/) (7)
 * [SSL](https://immanuelraj.dev/category/ssl/) (3)
 * [Terminal](https://immanuelraj.dev/category/terminal/) (1)
 * [Tools](https://immanuelraj.dev/category/tools/) (2)
 * [Uncategorized](https://immanuelraj.dev/category/uncategorized/) (8)
 * [Web](https://immanuelraj.dev/category/web/) (2)
 * [WordPress](https://immanuelraj.dev/category/wordpress/) (1)

---

## Useful Links

Links I found useful and wanted to share.

 * [Sponsor Me](https://github.com/sponsors/iamimmanuelraj)

---

## Search the website

Search