--- title: "My Newsletter Went to Spam: How I Fixed Email Deliverability for Free with Cloudflare" date: "2026-01-14" slug: "fix-newsletter-spam-with-cloudflare-email-routing" author: "Dany Paredes" canonical: "https://danywalls.com/fix-newsletter-spam-with-cloudflare-email-routing" description: "A friend told me my emails were hitting his Spam folder. Here is how I fixed my deliverability using Cloudflare Email Routing and custom domain authentication for $0." --- It started with a WhatsApp message from a friend: *"Hey, I subscribed to your newsletter, but I never received the confirmation email."* I told him to check his Spam folder. *"Yep, it's right here,"* he replied. That was an immediate red flag. I rushed to check my **Kit (ConvertKit)** dashboard and noticed a troubling trend: my open rates had plummeted over recent months. I was sending newsletters using my personal `@gmail.com` address, assuming that was good enough for a personal developer blog. **It turns out I was breaking the fundamental rules of email authentication.** Let's look at why personal email addresses fail at sending newsletters and how to fix it permanently. --- ## 1. The Core Problem: DMARC, SPF, and "Fake" Senders 🚫 In early 2024, Google and Yahoo introduced strict anti-spam enforcement rules. In short: > **If an email claims to be from `@gmail.com` but originates from a third-party server (Kit, Mailchimp, Resend, or Brevo), email providers treat it as email spoofing.** To pass automated email security filters, email providers check three key records: 1. **SPF (Sender Policy Framework):** Declares which servers are authorized to send emails for your domain. 2. **DKIM (DomainKeys Identified Mail):** Adds a cryptographic digital signature to verify the email was not altered in transit. 3. **DMARC (Domain-based Message Authentication, Reporting, and Conformance):** Tells receiving mail servers how to handle messages that fail SPF or DKIM checks (e.g. `p=none` or `p=quarantine`). You cannot configure SPF or DKIM keys for the `@gmail.com` domain because Google owns it. You **must** send from a custom domain (like `hola@danywalls.com`). **The dilemma?** Paying $6 to $10 per month for a Google Workspace or Microsoft 365 mailbox just to send a weekly blog newsletter adds up quickly. Let's look at how Cloudflare solves this without extra monthly subscriptions. --- ## 2. The Solution: Cloudflare Email Routing + Custom Domain ☁️ If your domain DNS is managed by **Cloudflare**, you have access to a built-in feature called **Cloudflare Email Routing**: * **Inbound (Receiving):** Anyone emailing `hola@danywalls.com` has their message automatically forwarded to `my-personal@gmail.com` by Cloudflare. * **Outbound (Sending):** Your newsletter platform (Kit, Resend, or Mailchimp) sends emails with your custom sender identity (`hola@danywalls.com`) signed with your domain's verified DKIM/SPF keys. This architecture gives you 100% email deliverability and professional branding for **$0/month**. Now let's walk through the 10-minute implementation guide. --- ## 3. Step-by-Step Implementation Guide 🛠️ ### Step 1: Enable Email Routing in Cloudflare 1. Open your **Cloudflare Dashboard** and select your domain. 2. Navigate to **Email** > **Email Routing**. 3. Click **Get Started** and configure your custom address: * **Custom Address:** `hola` (creates `hola@danywalls.com`) * **Destination Address:** `your-personal-email@gmail.com` 4. Cloudflare sends a confirmation email to your personal inbox. Click the verification link to activate forwarding. 5. Accept Cloudflare's prompt to automatically add the required MX and TXT records to your DNS zone. Now incoming emails to your custom domain land cleanly in your personal inbox. Let's configure outbound sending verification next. --- ### Step 2: Add Verified Sending Domain in Your Email Provider Whether you use Kit, Mailchimp, or Resend, the verification process is identical: 1. In your email provider's settings, find **Sending Domains** or **Verified Domains**. 2. Enter your root domain (e.g. `danywalls.com`). 3. Your provider will generate **3 CNAME records** containing your unique DKIM public keys. --- ### Step 3: The Critical Gotcha with Cloudflare DNS (Gray Cloud vs. Orange Cloud) ⚠️ When copying these CNAME records into Cloudflare DNS, there is one critical step developers frequently miss: > [!IMPORTANT] > **Disable the Orange Cloud (Proxy) for all DKIM CNAME records.** > Set them to **DNS Only (Gray Cloud)**. If the Cloudflare proxy is active, Cloudflare intercepts DNS requests and returns its own proxy IPs, preventing your email provider from verifying the DKIM keys. ```text Type: CNAME Name: kit1._domainkey.danywalls.com Target: dkim.kit-verify.com Proxy status: DNS only (Gray Cloud) ☁️ ``` Once saved, DNS propagation takes 2 to 5 minutes. --- ### Step 4: Add DMARC Record for Safe Policy Enforcement To satisfy Google and Yahoo's requirements completely, add a simple TXT record for DMARC: ```text Type: TXT Name: _dmarc Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@danywalls.com; ``` A policy of `p=none` allows you to monitor deliverability without risking legitimate emails being rejected while you test. Let's test the result. --- ## 4. Verifying Deliverability and Inbox Placement 📬 Once your domain shows as **Verified** in your email dashboard: 1. Update your Default Sender Email to `hola@danywalls.com`. 2. Send a test broadcast to a personal Gmail and Yahoo account. 3. Open the email in Gmail, click the three dots (`⋮`), and select **"Show Original"**. 4. Confirm that **SPF, DKIM, and DMARC** all display green **PASS** badges. Your emails will now consistently land in the Primary Inbox rather than the Spam or Promotions tab. --- ## Recap 💡 Email deliverability is invisible technical debt: you rarely notice it until subscriber engagement drops. * **Sending newsletters from `@gmail.com` fails modern DMARC authentication.** * **Cloudflare Email Routing** provides free inbound forwarding directly to your personal mailbox. * **DKIM CNAME records must be set to DNS Only (Gray Cloud)** in Cloudflare to verify successfully. * **Adding a DMARC TXT record** ensures compliance with Google and Yahoo inbox rules. If you are looking to optimize your cloud hosting and developer setup, check out my guide on [Migrating Next.js from Vercel to Google Cloud Run](/migrating-nextjs-from-vercel-to-gcp) and [Improving Your Cloud Skills as a Frontend Developer](/how-to-improve-cloud-skill-as-frontend)! Happy writing and coding!