Add Your Reply Domain Records in Cloudflare

Cloudflare takes all four records without complaint. One setting decides whether the domain verifies or not: the proxy status on the CNAMEs has to be DNS only. A proxied CNAME returns Cloudflare’s own answer instead of the SendGrid target, so the DKIM lookup fails and the domain sits at pending.

Copy the real values from the domain screen in Know Reply before you start. Three of the four are unique to your domain.

Add the records

1. In the Cloudflare dashboard, select your domain, then go to DNS, then Records.
2. Click Add record. Choose MX. Enter reply in Name, mx.sendgrid.net in Mail server, and 10 in Priority. Leave TTL on Auto and click Save.
3. Click Add record again. Choose CNAME. Enter the host from the Know Reply screen with your domain removed, for example em1234.reply. Enter the SendGrid target in Target.
4. Click the orange cloud under Proxy status so it turns grey and reads DNS only, then click Save.
5. Repeat steps 3 and 4 for s1._domainkey.reply and s2._domainkey.reply.

Cloudflare appends your domain, so type s1._domainkey.reply, not s1._domainkey.reply.yourbrand.com. The list shows the full name after saving. If you see s1._domainkey.reply.yourbrand.com.yourbrand.com, delete it and re-enter the short form.

Three things that break this in Cloudflare

A proxied CNAME. Cloudflare blocks proxying for a handful of known DKIM targets, but not for SendGrid’s. Nothing warns you. Check the proxy status column reads DNS only on all three CNAMEs before you press Check DNS in Know Reply.

Flatten all CNAMEs. Under DNS, then Settings, CNAME flattening defaults to Flatten CNAME at root, which is fine. Set to Flatten all CNAMEs and your DKIM records resolve to IP addresses that SendGrid cannot read. Leave it on the default.

Email Routing. If Cloudflare Email Routing is enabled on the zone it manages MX records and will flag the new one as a conflict. Email Routing operates on the addresses you configure in it, so an MX on an unrelated subdomain is not actually a conflict, but you may need to dismiss a warning to save the record.

Then check it

Cloudflare propagates in seconds to minutes. Go back to the domain screen in Know Reply and click Check DNS. If one record is still red, the screen names which one.

Full record reference and what each one does: How a reply domain works.