FindLeadEmails
Email intelligence
Try it for free
DNS host · SPF

SPF record for Cloudflare

How to add a SPF record when DNS or mail is at Cloudflare. Real steps, then a live lookup.

If the domain is proxied (orange cloud), that does not affect TXT records. MX and TXT stay DNS-only.

  1. DNS > Records > Add record > TXT.
  2. Name @, content v=spf1 … ~all. Proxy status does not apply to TXT.
  3. One SPF record only. Merge includes.

Official docs: Cloudflare. Other records for this provider: SPF · DKIM · DMARC

Does this page apply to you?

Run this first. Cloudflare only matters if it is where your DNS or mail actually lives.

dig +short NS yourdomain.com

Expect: Two names ending in .ns.cloudflare.com. If you see anything else, DNS is hosted elsewhere and edits here will have no effect.

Specific to Cloudflare

  • In the dashboard, enter @ as the name for the root domain. Cloudflare appends the zone name for you.
  • If Cloudflare Email Routing is enabled on the domain, it adds its own SPF record (include:_spf.mx.cloudflare.net). Merge that into your single record rather than adding another.
  • TXT records cannot be proxied, so the orange-cloud toggle does not appear for them. There is nothing to configure.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  @  v=spf1 include:_spf.google.com include:<your-sequencer> ~all

What the receiving server does with this record

On every incoming message the receiver reads the domain in the envelope sender (the Return-Path), fetches its TXT records, picks the one that starts v=spf1, and checks whether the sending IP is covered. It is a check on which servers may send for a domain, not on the visible From address; DMARC is what ties the two together.

Mistakes that break it

  • Two SPF records. A domain may have exactly one. Publish a second and SPF returns a permanent error, which receivers treat as a failure. Merge instead.
  • Over ten lookups. Each include costs a lookup plus whatever is inside it. See the SPF lookup limit.
  • A sender missing. Your sequencer, CRM and billing tool all send as your domain and each needs its include in this one record.
  • Wrong domain. SPF is not inherited by subdomains. If you send from mail.yourdomain.com, that name needs its own record.

Check it from the command line

Replace yourdomain.com and look for exactly one line that starts with "v=spf1:

dig +short TXT yourdomain.com

Check it live

Check the SPF record

Look up the live DNS after you save. This tool does not spend credits.

v=spf1 include:_spf.google.com ~all

Publish as a single TXT record on the apex. Never create two SPF records.

Related