Skip to content

Check F1 · DNS and origin exposure

F1: Your MX record points at a proxied host, so mail has nowhere to arrive

Check F1 of Edge Doctor for Cloudflare® follows your MX records and reports when the mail host in your own zone resolves to a Cloudflare address.

Last reviewed 2026-10-30Plugin version 1.0.1Cloudflare dashboard paths checked 2026-10-25

What the check looks at

F1 reads the MX records of your domain and resolves each mail host. A host counts as yours when it is in your own DNS zone and answers with an A or AAAA record there; CNAME chains are followed up to 5 steps, and a chain that leaves your zone makes the host external.

Your zone is found by walking up to the SOA record, so domains such as example.co.uk work. Mail hosts ending in .mx.cloudflare.net (Cloudflare Email Routing) are expected to point at Cloudflare.

Results and what they mean

ResultWhat it means
PassedConfidence: HighYour mail host is reachable
No mail exchanger points at a Cloudflare address. With Email Routing the result says it is working as intended.
PassedConfidence: HighYour mail goes to your mail provider
Your MX points outside your zone, at a provider whose host has a Cloudflare address. That record belongs to the provider, not to your DNS, so there is nothing to change.
FailedConfidence: HighYour mail host points at Cloudflare
A mail exchanger in your own zone resolves to a Cloudflare address. Messages sent to this domain have nowhere to arrive.
Could not checkConfidence: LowThis check could not be completed
The zone could not be found, or PHP cannot make DNS queries.
Not applicableThis domain has no MX records
Reason no_records.
Not applicableCloudflare is not in front of this site
Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare.

When the result names a reason

  • zone_not_found: The plugin could not find the DNS zone of this site, so it cannot tell which names belong to it. F1 never reports a failure without knowing the zone.
  • php_function_unavailable: A PHP function this check needs is turned off on your server. F1 needs dns_get_record() or gethostbynamel().
  • no_records: There are no DNS records of the kind this check reads.
  • not_behind_cloudflare: This site is not behind Cloudflare.

Symptoms you may notice

  • Email sent to addresses at your domain bounces or never arrives, often right after the domain moved to Cloudflare.
  • Outgoing mail still works, which makes it easy to miss.

Why it happens

Only A, AAAA and CNAME records can be proxied; MX records are always DNS only (Cloudflare: proxy status). But the MX record names a host, and when that host’s A record is proxied, it resolves to Cloudflare, which does not accept mail for it. Proxying other TCP traffic, mail included, needs Spectrum, which for custom TCP applications requires an Enterprise plan (Cloudflare: Spectrum protocols per plan).

Confirm it by hand

dig +short MX example.com
dig +short mail.example.com

If the mail host resolves to an address in the ranges at cloudflare.com/ips, it is proxied.

How to fix it

In Cloudflare: find the A or AAAA record of the host your MX points at (often mail) and set its proxy status to DNS only, the grey cloud. That record then shows your mail server’s address, so check F2 for what it reveals.

DNS > Records > Edit, Proxy status: DNS onlyPath checked on 2026-10-25 against the Cloudflare documentation. Cloudflare moves dashboard items from time to time; if the path differs, search the dashboard for the setting name.

If the zone uses Spectrum for mail, the record is meant to be proxied and this finding does not apply.

In WordPress: nothing to change.

Limitations

F1 checks where mail is delivered, not whether the mail server accepts it. A correct record pointing at a broken mail server is not detected.

Sources

Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.

Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.