Do not proxy non-web services

I only realized I broke my Postmark setup after receiving an alert email from Postmark:

It looks like your custom Return-Path DNS record for [domain] is no longer valid. We run periodic checks to make sure your custom Return-Path DNS record is still valid. If the record is missing, your domain will no longer pass DMARC’s SPF check.

The cause was that when I shifted my DNS from Porkbun to Cloudflare, I accidentally proxied the Return-Path DNS record. The Cloudflare proxy is meant for web traffic only. When I used it for non-web services such as Postmark, Postmark couldn't verify my DNS record.

The solution was simply to turn off the proxy for the Return-Path DNS record, switching from "Proxied" (Orange Cloud) to "DNS Only" (Grey Cloud).

Rule of thumb:

• Orange Cloud (Proxied): Only for web traffic to enable speed, security, and SSL
• Grey Cloud (DNS Only): For everything else, such as email (MX, SPF, DKIM, DMARC), domain verification tokens (Google/Microsoft), and direct server management connections (SSH/FTP)