
Email Security
How Cloudflare DNS Silently Breaks DMARC When ESPs Auto-Deploy Through Entri
May 5, 2026
A specific combination of Cloudflare DNS, a CNAME-based DMARC delegation, and an ESP onboarding through Entri can silently bypass p=reject — leaving domains spoofable while every dashboard reports green. Here's how the conflict happens, how to detect it with dig, and how to fix it.