# Outlook Can't Connect to Your cPanel Email? Check This Cloudflare DNS Setting

- Source: https://simeoncreatives.com/blog/outlook-cpanel-email-cloudflare-dns
- Hub: Website Design & Development
- Author: Simeon Matheka, Founder & Creative Director
- Published: 2026-08-26
- Updated: 2026-08-26
- Reading time: 9 min

cPanel webmail sent and received fine. Outlook refused to connect with the same password, port 993, and SSL. The mail hostname was proxied through Cloudflare. DNS only fixed it.

cPanel webmail was fine. Same mailbox, same password. Outlook would not add the account.

This showed up on a client site we had put on Cloudflare for the website, while they kept using cPanel email. The orange cloud is the right default for the site. It is the wrong default for the mail hostname.

If you are in that split (site through Cloudflare, mail still on the origin), check Domain Name System (DNS) proxy status before you reset the password again.

## What we saw in Outlook

We added the account as Internet Message Access Protocol (IMAP) with the host’s Secure Sockets Layer / Transport Layer Security (SSL/TLS) settings. Incoming port 993. Outgoing Simple Mail Transfer Protocol (SMTP) on 465. SSL on both. Advanced settings on.

Outlook returned:

> Unable to log in. Please check your incoming server settings including server name, port, and security protocol.

That line is a trap. It sounds like a typo, a bad password, or the wrong port. We had already confirmed the mailbox in webmail, so credentials were not the story.

![Outlook Add Account screen for IMAP showing ports 993 and 465 with SSL, and a red error: Unable to log in. Please check your incoming server settings including server name, port, and security protocol.](/images/blog/outlook-cpanel-email-cloudflare-dns/outlook-imap-unable-to-log-in.webp)
*The error blames server name, port, and security protocol. Those were already correct. DNS was not.*

## Why webmail still worked

https://webmail.example.com is a website. The browser talks HTTPS. Cloudflare’s proxy is built for that. Orange-clouding webmail can still load Roundcube (or Horde), and the UI talks to the mail stack on the origin.

Outlook does not open that page. It connects to whatever IP mail.example.com resolves to, on IMAP and SMTP ports. If that hostname is proxied, the name resolves to Cloudflare anycast IPs. The HTTP proxy does not carry IMAP 993 or SMTP 465. The handshake dies. Webmail looks healthy. The client looks broken.

The working mental model:

- **Webmail works: **the mailbox and password are fine.
- **Outlook fails: **the path from the client to the mail daemon is wrong. DNS proxy status is a common reason.

## The Cloudflare proxy is HTTP-only

Cloudflare DNS records on A, AAAA, and CNAME can be Proxied (orange cloud) or DNS only (grey cloud). Proxied is what you want for the site: the apex, www, and HTTP APIs. You get Distributed Denial of Service (DDoS) protection, caching, and the Web Application Firewall (WAF).

Email is not HTTP. Cloudflare’s proxy-status use cases are explicit: a hostname used exclusively for email should be DNS only. Mail Exchanger (MX) records cannot be proxied. If you orange-cloud mail.example.com, mail servers and clients connect to Cloudflare instead of the origin, and delivery or login fails. See [Cloudflare’s proxy use cases](https://developers.cloudflare.com/dns/proxy-status/use-cases/).

Two related rules that save a second ticket:

- **File Transfer Protocol (FTP), Secure Shell (SSH), and similar: **also DNS only. The HTTP proxy drops those protocols too. In the screenshot below, ftp is still orange. That is a sibling bug, not the Outlook one.
- **MX pointed at a proxied name: **Cloudflare may inject a _dc-mx prefix so inbound mail bypasses the proxy. That can hide the problem for receiving mail while IMAP to mail.example.com still fails. Do not treat “mail is arriving” as proof that the mail hostname is correct.

Cloudflare Spectrum can proxy SMTP if you buy and configure it. That is not a default cPanel setup. Do not orange-cloud mail hoping Spectrum is on.

## The fix: set the mail hostname to DNS only

In Cloudflare: domain → DNS → Records. Find the A (or AAAA) record for the hostname the client actually uses. On cPanel that is usually mail.example.com, the same name in IMAP and SMTP fields.

![Cloudflare DNS records table. The mail A record is set to DNS only with a grey cloud, highlighted. ftp, webdisk, and webmail A records are Proxied with orange clouds. A CAA record is DNS only.](/images/blog/outlook-cpanel-email-cloudflare-dns/cloudflare-mail-record-dns-only.webp)
*mail is DNS only (grey). webmail can stay Proxied because it is HTTPS. ftp should not be orange, but that is a separate fix.*

1. If Proxy status is Proxied, click it and switch to DNS only.
2. Save. Grey cloud, not orange.
3. Wait for local DNS cache. Time to Live (TTL) Auto is often 5 minutes on Cloudflare, but the laptop may hold the old IP longer. Flush cache or wait, then retry Outlook.

On this client, that was the whole fix. Same ports. Same password. Outlook connected.

## The origin IP warning is expected

When you switch Proxied to DNS only, Cloudflare warns that the origin IP is now exposed. Believe the warning. Do not undo the change because of it.

A proxied record answers with Cloudflare IPs. A DNS-only record answers with the server IP. Mail needs that. Anyone who looks up MX for the domain already learns where mail is accepted. Orange-clouding mail.example.com does not hide the box. It only breaks IMAP.

If hiding the web origin actually matters (targeted attacks on the hosting IP), do not try to paper over it by proxying mail. Move mail off that IP: Google Workspace, Microsoft 365, or another host whose MX is not your web server. Then the website can stay proxied and the mailbox does not share the origin. For most small business cPanel setups, DNS-only mail plus a proxied site is the correct split. Same idea as the rest of [post-launch maintenance](https://simeoncreatives.com/blog/modern-web-maintenance-blueprint): each service gets the DNS shape it needs, not a copy of the homepage.

## What a healthy split looks like

Do not copy another domain’s values. Copy the pattern. Confirm names and IPs with the host.

| Record | Typical name | Proxy |
| --- | --- | --- |
| Website | example.com, www | Proxied |
| Mail hostname | mail.example.com | DNS only |
| MX | example.com → mail.example.com | Cannot be proxied |
| Webmail | webmail.example.com | Proxied is OK (HTTPS) |
| FTP | ftp.example.com | DNS only |
| SPF / DKIM / DMARC | TXT (and DKIM CNAME if used) | DNS only (no HTTP proxy on TXT) |

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are TXT (or CNAME) records. They never ride the HTTP proxy. Still keep them correct. They are not why Outlook failed here, but they are why mail from the domain lands in the inbox after you fix login.

## If DNS only did not fix it

Change one thing at a time. Do not grey-cloud the whole zone.

1. **Confirm the hostname the client uses. **If Outlook is set to mail.example.com, that record is the one that must be DNS only. A proxied autodiscover or webmail name is a different question.
2. **Confirm MX. **It should point at the mail host the company actually uses, not a leftover Google or Microsoft target from a failed migration.
3. **Flush DNS, then retry. **macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. Windows: ipconfig /flushdns.
4. **Stay on SSL with the published ports. **cPanel’s usual secure pair is IMAP 993 and SMTP 465. Turning SSL off to “make it work” trades a DNS bug for an interceptable login.
5. **Skip Autodiscover if Outlook keeps guessing. **cPanel can publish AutoConfig and Autodiscover, and the default Outlook SRV target is often cpanelemaildiscovery.cpanel.net. cPanel also documents that Autodiscover does not work with Outlook 2016, Outlook 2019, Outlook for Microsoft 365, or typical mobile clients. Add IMAP manually, which is what we did.
6. **Read the next error. **Certificate name mismatch, app passwords, SMTP authentication off, or a firewall on 993/465 are different failures. They show up after the proxy is out of the way.

The lesson is not “Cloudflare is bad for email.” It is that proxy status is a protocol decision. HTTP gets the orange cloud. IMAP, SMTP, FTP, and SSH get grey. Mix them on one hostname and you get this ticket: webmail fine, Outlook loud. If you are putting a cPanel site on Cloudflare and keeping origin mail, set mail to DNS only in the same pass as the website cutover. That belongs in the launch checklist, not in a panicked Friday Outlook thread. We treat it as part of [website delivery](https://simeoncreatives.com/websites), not a mystery add-on. If you are stuck on a live mailbox, [get in touch](https://simeoncreatives.com/contact).

## FAQs

### Why does cPanel webmail work when Outlook cannot connect?

Webmail is a website. It uses HTTPS, so it can sit behind Cloudflare’s HTTP proxy. Outlook talks to the mail server with Internet Message Access Protocol (IMAP) and Simple Mail Transfer Protocol (SMTP). Those are not HTTP. If mail.example.com is orange-clouded, Outlook hits Cloudflare IPs instead of the origin mail server and the login fails.

### Should the mail hostname be Proxied or DNS only on Cloudflare?

DNS only (grey cloud). Cloudflare’s standard proxy is for HTTP and HTTPS. A hostname used for Internet Message Access Protocol (IMAP), Simple Mail Transfer Protocol (SMTP), or Post Office Protocol version 3 (POP3) should not be proxied. Mail Exchanger (MX) records cannot be proxied either.

### Is DNS only unsafe because Cloudflare warns that the origin IP is exposed?

The warning is expected, not a reason to orange-cloud mail again. A DNS-only A record returns the real server IP. Mail already reveals that IP to anyone who looks up MX. Proxying the mail hostname does not hide the origin. It just breaks clients. If you truly cannot expose the web origin, host mail on a separate provider whose MX does not point at that server.

### What IMAP and SMTP ports should I use for cPanel email?

Use the host’s published values. A typical cPanel SSL setup is Internet Message Access Protocol (IMAP) on port 993 and Simple Mail Transfer Protocol (SMTP) on port 465 (or 587 with STARTTLS), both with a valid certificate. Those ports were already correct in the case that started this article. The failure was Domain Name System (DNS) proxy status, not the ports.

### I set mail to DNS only and Outlook still will not connect. What next?

Confirm Mail Exchanger (MX) points at the real mail host, wait for Domain Name System (DNS) cache to expire, then check the certificate name, username (often the full email address), and authentication. Newer Outlook builds often skip cPanel Autodiscover, so add the account as Internet Message Access Protocol (IMAP) manually. Do not flip every record to grey while you guess.