How to Add an SPF Record in Cloudflare

The short answer. Add one TXT record in Cloudflare with the host @ and a value that starts with v=spf1 and lists every service that sends mail for you, for example v=spf1 include:_spf.google.com ~all. A domain may have only one.

---

What an SPF Record Does#

SPF is a list of the servers allowed to send mail for your domain. Receivers check the sending server against it, and mail from anywhere else can be marked as spam or rejected. It is a TXT record at the root of the domain.

Check Where Your DNS Is Managed#

A record only works at the company that answers DNS for the domain, which is not always the one you bought it from. Cloudflare serves DNS only when the domain’s nameservers are two Cloudflare ones (they end in ns.cloudflare.com). The domain’s Overview page shows Active when that is the case.

The SPF Record to Add#

v=spf1 include:_spf.google.com ~all

The include part depends on who sends your mail. Use the value your mail provider gives you. Two common ones:

A domain that sends no mail at all should say so: v=spf1 -all. Several senders go in one record, each with its own include, before the ending:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

The ending ~all marks other senders as suspicious. -all rejects them. Start with ~all and move to -all when you are sure the list is complete.

Step by Step in Cloudflare#

Step 1. Open the domain

Sign in to the Cloudflare dashboard and click the domain on the Websites page.

Step 2. Open DNS Records

In the left menu choose DNS, then Records.

Step 3. Add a record

Click Add record. The form opens above the list.

Step 4. Enter the SPF record

Choose TXT as the type and fill in the fields:

• Name: @
• Content: v=spf1 include:_spf.google.com ~all
• TTL: Leave TTL on Auto.

The value to copy:

v=spf1 include:_spf.google.com ~all

Step 5. Save

Click Save. Cloudflare shows the record in the list at once.

Change an Existing SPF Record#

Look for an existing TXT record at @ that starts with v=spf1 before you add anything. If there is one, edit it instead of adding another. Click Edit at the end of the row to change it, and Delete inside that panel to remove it. Click Save.

Keep everything that is already allowed and add the new include before the ending. To allow a new service, change:

v=spf1 include:_spf.google.com ~all

to:

v=spf1 include:_spf.google.com include:newservice.example ~all

Common Mistakes#

• Creating a second SPF record. Two records make SPF fail with a permanent error. Merge them into one.
• Replacing the old record instead of adding to it, which drops a sender that was working.
• Going past ten DNS lookups. Every include counts, and so do the ones inside it. Past ten, SPF fails for everyone.
• Ending with +all, which allows the whole internet to send as you.
• Leaving out v=spf1 at the start. Without it the record is not SPF.
• Wrapping the value in quotes. Cloudflare adds them itself; typed quotes become part of the value.

Check That It Worked#

A TXT lookup for the domain itself should list one value that starts with v=spf1. Send a test email to a Gmail address and check the original message headers for spf=pass. Changes show up as caches expire, usually within minutes for a record and up to two days for nameservers, see how long DNS propagation takes.

More Cloudflare DNS Guides#

• How to Add a DMARC Record in Cloudflare
• How to Add a TXT Record in Cloudflare
• How to Change Nameservers in Cloudflare
• How to Add MX Records in Cloudflare

The same task elsewhere: Namecheap, GoDaddy, Hostinger, Squarespace.

Menu names last checked October 2026. Providers rename things now and then; if a label differs, look for the closest match.