Separate web traffic from mail routing
Cloudflare's proxy status applies to supported DNS record types and HTTP-related services. Email delivery follows MX records and the hostnames they name; it should not be assumed to work through a normal web proxy. Follow the current provider documentation for the mail service and DNS records you use.
Before changing a website's A, AAAA or CNAME record, inventory MX records, mail hostnames, SPF, DKIM, DMARC and any third-party senders. The website and email may be hosted by different providers.
Check the destination host
An MX record points to a hostname. Confirm that hostname resolves to the intended mail service and is configured as required by the mail provider. If a separate mail hostname is needed, keep its DNS and proxy settings aligned with the provider's instructions rather than reusing a web-only path blindly.
Verify inbound SMTP reachability, the certificate presented to mail clients and the correct hostname in client settings. A web certificate working through Cloudflare does not prove the mail server's certificate or mail protocol path is correct.
Validate both directions
After a change, query public DNS from more than one resolver and allow for cached answers. Send a controlled test to and from an approved mailbox. Check the receiving and sending logs and confirm authentication results where available.
Keep a copy of the previous DNS configuration and a rollback plan. Do not remove authentication records or change MX records during a web migration unless the mail migration requires it and all senders have been inventoried.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.