Add an SPF record at Cloudflare

The SPF value for Cloudflare

Cloudflare does not run mailboxes. The value depends on the mail provider: Microsoft 365 needs include:spf.protection.outlook.com, Google Workspace include:_spf.google.com, other providers publish their include in their help. The example below is for Microsoft 365.

v=spf1 include:spf.protection.outlook.com -all

When other services send as well

A newsletter tool, CRM, ticket system or Microsoft 365 alongside the Cloudflare mailboxes: every service goes into the same record as its own include. There must be only one TXT record with v=spf1; a second one invalidates both. At most ten DNS lookups are allowed, Google Workspace costs four, Microsoft 365 two, most newsletter tools one or two.

v=spf1 mx include:spf.protection.outlook.com include:spf.brevo.com -all

How to add the SPF record at Cloudflare

The way to the Cloudflare DNS editor:

• In the Cloudflare dashboard open the domain and choose "DNS" → "Records".
• Choose "Add record" and enter type, name and content.
• For MX, TXT and mail-related CNAME records keep the proxy status on "DNS only"; the orange cloud belongs to web records only.
• Type TXT, host name @ (at some hosts leave empty or pick the domain name), value: the full SPF record starting with v=spf1. If a TXT record with v=spf1 already exists, edit it rather than adding a second one.
• Save; Cloudflare propagates instantly.

Typical mistakes at Cloudflare

• Two TXT records with v=spf1: both are ignored. Always edit the existing one.
• The record sits on www or a subdomain instead of the apex domain.
• Quotation marks typed into the value: the DNS editor adds them itself.
• More than ten lookups after adding further services.

Verify and keep an eye on it

After saving, the change at Cloudflare usually applies within minutes. The checker below queries the authoritative name servers and shows right away whether the SPF record is read correctly. DomainWarn keeps checking the record afterwards and alerts you when it changes or disappears, for example after a migration or one click too many in the DNS editor.

Frequently asked questions

Where do I find the SPF value in the Cloudflare control panel?

Not at Cloudflare: the value comes from the mail provider, Cloudflare only manages the DNS record.

How long until the SPF record takes effect?

At Cloudflare usually minutes, at the latest once the TTL of the old record has expired. Receivers query the record with every message.