How to set up Plesk, mail autodiscover and Cloudflare to work together properly manually?

Question

• How to make Plesk, mail autodiscover and Cloudflare work correctly?
• How to set up Plesk, mail autodiscover and Cloudflare to work together for a domain?
• How to configure Plesk, mail autodiscover and Cloudflare to work together for a website?

Answer

The end goal of the setup provided below is to leave mail.example.com in the DNS Only status on the side of Cloudflare and set up mail autodiscover on the side of Plesk to use mail.example.com as the Incoming and Outgoing mail server to be autodiscovered by mail clients.

Warning: These setup steps are entirely manual and should be executed only while the DNS Integration for Cloudflare® extension is not installed or used on the Plesk server

In order to set up Cloudflare to work with mail autodiscover and websites hosted on a Plesk server, you must follow these steps:

1. A Wildcard Let's Encrypt SSL certificate (or a Wildcard SSL from a different SSL vendor) must be issued and installed for example.com and the hostname of the server (server.example.com) on the side of Plesk

Note: SSL certificates issued by Cloudflare do not have the ability to secure mail server connections on SMTP, POP3 and IMAP ports, due to which they cannot be used to secure email transactions.

2. The domain should be using the Wildcard SSL certificate issued on the side of Plesk for mail transactions (Go to Plesk > Domains > example.com > Mail > Mail Settings tab, select the SSL/TLS certificate for mail, and press Apply)

3. SSL/TLS mode in Cloudflare for the domain should be set to Full (Strict)

4. The mail autodiscovery settings on the side of Plesk should be adjusted to use mail.example.com instead of example.com for the autodiscovery process initiated by mail clients. This can be done by doing the following:

Click on a section to expand

5. DNS records for the domain on the Plesk side should be set according to the following example (Replace 203.0.113.2 with your Plesk server IP, example.com with your domain and server.example.com with your Plesk server hostname):

Click on a section to expand

6. DNS records within the Cloudflare DNS zone for the domain should be set according to the following example (Replace 203.0.113.2 with your Plesk server IP, example.com with your domain and server.example.com with your Plesk server hostname):

Click on a section to expand

7. Mail autodiscover should be enabled on the Plesk side both server-wide and for the domain

Note: Even if mail autodiscover was enabled server-wide and for the domain already, it is recommended to disable and enable it once again after the changes, so that they may get picked up by the Plesk configuration correctly.

Note: If you encounter redirection issues while attempting a Plesk login by using the server hostname after starting to use Cloudflare, you may resolve them by following the steps in the A user is being logged out from Plesk periodically or Plesk redirects to the login page after a successful login attempt  article. Alternatively, you may switch the proxy status for the server hostname (server.example.com) record on Cloudlare's end to DNS Only.

Additional information

Manage DNS records | Cloudflare DNS docs