How to Add an SPF Record to Cloudflare DNS Without Breaking Email

Setting up an SPF record in Cloudflare involves adding a specific TXT record to your domain's DNS manager to authorize which mail servers can send email on your behalf. Without a properly configured SPF record, your outbound emails may land in spam folders or face outright rejection by strict receiving servers.

Before you make any changes to your production settings, you should validate your current configuration using the SPF Checker tool on XiaTools to identify existing records, syntax errors, or potential lookup limit violations.

Understanding SPF and Cloudflare DNS

Sender Policy Framework (SPF) is an email authentication standard designed to detect forging sender addresses during the delivery process. It works by publishing a list of authorized IP addresses and service providers in your domain's DNS records.

Cloudflare acts as your authoritative DNS provider, but it does not send or process email by default. This separation means you must explicitly tell Cloudflare which external providers—such as Google Workspace, Microsoft 365, or specialized marketing platforms—are allowed to send messages using your domain name.

The Anatomy of an SPF Record

An SPF record is always published as a DNS TXT record. It begins with a version declaration followed by a series of mechanisms and modifiers that define authorization rules.

• Version (v=spf1): Identifies the record as an SPF version 1 string, which is the universal standard.
• Mechanisms (ip4, ip6, include, a, mx): Define the specific servers or addresses permitted to send email.
• Qualifiers (+, -, ~, ?): Determine how receiving servers should treat emails from unauthorized sources. Most setups use the softfail (~all) or fail (-all) qualifier.

Step-by-Step Cloudflare SPF Record Setup

Follow these precise steps to add or update your SPF record inside the Cloudflare dashboard without disrupting your active email flow.

Step 1: Gather Your Authorized Email Sources

Make a definitive list of every service that sends email on behalf of your domain (example.com). Common sources include:

• Your business email provider (e.g., Google Workspace, Microsoft 365).
• Your transactional email service (e.g., SendGrid, Mailgun).
• Your CRM or marketing platform (e.g., HubSpot, Mailchimp).
• Your web hosting provider if it generates contact form notifications directly from server@example.com using IP range `192.0.2.25

Step 2: Construct Your SPF String

Combine your gathered sources into a single, cohesive string. Never create multiple SPF records for the same domain, as this violates protocol specifications and invalidates authentication.

v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.0.2.25 ~all

Step 3: Log In to Cloudflare and Navigate to DNS

1. Log in to your Cloudflare account and select your target domain (example.com).
2. In the left-hand sidebar menu, click on DNS, then select Records.
3. Review your existing records to ensure there are no conflicting or duplicate TXT records starting with v=spf1.

Step 4: Add the TXT Record

1. Click the Add record button.
2. Set the Type dropdown to TXT.
3. In the Name field, enter @ to represent the root domain (example.com), or enter your subdomain prefix if you are setting up SPF for a sub-origin.
4. In the Content field, paste your complete SPF string.
5. Leave the TTL (Time To Live) set to Auto or select a standard value like 3600 seconds.
6. Click Save.

Note: SPF records are used exclusively by mail transfer agents for authentication lookup. Cloudflare's orange-cloud proxy feature only applies to HTTP/HTTPS web traffic and should never be enabled for DNS records related to mail routing.

Verifying Your Configuration

Once your record is saved, verify that public DNS resolvers can see the update correctly. You can use command-line utilities or online tools to inspect the propagation.

Using Dig

Run the following command in your terminal to query the TXT records for your domain:

dig example.com TXT +short

Expected output sample:

"v=spf1 include:_spf.google.com ~all"

Using PowerShell (Windows)

If you are running Windows, use the following PowerShell cmdlet:

Resolve-DnsName -Name example.com -Type TXT

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into configuration pitfalls. Avoid these frequent errors to ensure high email deliverability.

1. Creating Multiple SPF Records

If you add one SPF record for Google Workspace and a separate one for Mailchimp, receiving servers will encounter a permanent error due to multiple records and reject your emails.

• The Fix: Combine all providers into a single TXT record using multiple include statements.

2. Exceeding the 10-DNS-Lookup Limit

The SPF specification limits recursive DNS lookups to a maximum of 10. Every include, a, mx, or ptr mechanism triggers a lookup. If your record requires 11 lookups, it fails completely.

• The Fix: Flatten your SPF record by replacing nested includes with direct static IP declarations (ip4: or ip6:) where possible, or remove redundant third-party services.

3. Using the ptr Mechanism

The ptr mechanism is deprecated because it is slow and unreliable for modern mail servers.

• The Fix: Remove ptr entirely from your string and rely solely on ip4, ip6, and explicit include mechanisms.

Quick Checklist for Cloudflare SPF Setup

• Identified all authorized email-sending third-party services.
• Combined all rules into exactly one TXT string starting with v=spf1.
• Ensured the total number of DNS lookups is 10 or fewer.
• Added the record to Cloudflare with the Name set to @.
• Kept the record set to DNS Only (gray cloud).
• Tested the record using a validation tool and dig commands.