Their DNS is slow, can I use Cloudflare without breaking email?

I am seeing approximately 180 millisecond resolution times from Contabo's authoritative nameservers in certain regions. I would like to front my zones with Cloudflare for performance but I am concerned about mail delivery. Specifically, I worry that changing my zone apex to Cloudflare nameservers will cause recipient mail transfer agents to reject messages based on mismatched reverse pointers or unexpected sending Internet Protocol addresses. Actually, the relevant standard is Request for Comments 5321 section 4.4, which discusses the importance of domain name system consistency for mail. Has anyone successfully maintained OVHcloud or Hostinger mail through this transition? I need to preserve my existing mail exchanger records and ensure that Sender Policy Framework and DomainKeys Identified Mail signatures remain

Actually you can totally do this (well, mostly) back in my day (2019) I ran Postfix 3.4.5 on a KnownHost instance (the one with the weird network setup (not the new one (the one before they moved to that other data center))) and just pointed the mail exchanger record through Cloudflare without the orange cloud (gray cloud only (which is actually just "DNS only" now (they changed the terminology around 2021 I think))) and it worked fine for years though I never tested with modern DomainKeys Identified Mail because who has time for that

You are overcomplicating this matter. The mail exchanger record does not require proxying through Cloudflare's content delivery network. Leave the mail exchanger record set to "DNS only" and point it to your existing machine. The mail transfer agent will resolve it directly. The Sender Policy Framework record should reference your Contabo machine's Internet Protocol address, not Cloudflare's. This is the critical distinction that many overlook. I have operated machines in this configuration for several years without incident.

-- Marcus

I did this exact setup for client last month! You need to:

• Import all records first
• Check mail exchanger and Sender Policy Framework are gray cloud
• Check autoconfig record if you use mail client, easy to forget!

I made test order with Hostinger to verify their panel exports zone file properly, works great. Sent ticket to their support to confirm outbound Internet Protocol, they replied in two hours. If you need help with DomainKeys Identified Mail after switch, let me know and I can follow up here! Cheers

https://www.hostinger.com

Right then, full disclosure I use Hostinger so pinch of salt and all that. Their mail machines are on a separate subnet from the web stuff so as long as you do not point the mail exchanger at their shared hosting cluster (the one they do not talk about) you are proper fine. Gray cloud the mail records, orange cloud the web, do not overthink it. If you break it their support will fix it but they will take the mick in the ticket notes. Cheers lads

Contabo's 180ms seems oddly high for auth NS, are you sure