How to Add an SPF Record in Cloudflare (Google Workspace and Microsoft 365)

SPF is a DNS record that lists which servers may send email for your domain. Without it, your mail is more likely to land in spam and your domain is easier to spoof. Here's how to add it when Cloudflare hosts your DNS.

Step 1: Check for an existing SPF record

In the Cloudflare dashboard, pick your domain and go to DNS > Records. Look for a TXT record on your root domain (shown as your domain name or @) whose content starts with v=spf1. A domain may have only one SPF record. If one exists, edit it and merge the new sender into it instead of adding a second.

Step 2: Add the record

Select Add record and fill in:

Type:    TXT
Name:    @
Content: (see below)
TTL:     Auto

Pick the content that matches your email provider:

Google Workspace:
v=spf1 include:_spf.google.com ~all

Microsoft 365:
v=spf1 include:spf.protection.outlook.com -all

Google Workspace plus a marketing tool (example):
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Each extra sending service (Mailchimp, SendGrid, your CRM) publishes its own include: value in its setup docs; add it before the ~all or -all at the end. Click Save. TXT records are never proxied, so there's no orange-cloud setting to worry about.

Step 3: Verify

Cloudflare changes usually go live within a few minutes. Check with:

dig +short TXT yourdomain.com

You should see exactly one string beginning with v=spf1.

~all or -all?

~all (soft fail) marks unlisted senders as suspicious; -all (hard fail) tells receivers to reject them. Once you're confident every service that sends your mail is listed, -all is stronger. Either way, pair SPF with a DMARC record so receivers know how to act on failures.

Common mistakes

• Two separate v=spf1 records. That causes a permanent SPF error and both are ignored.
• More than 10 DNS lookups. Every include:, a, mx, and redirect counts, and nested includes count too. Remove services you no longer use.
• Putting SPF on www instead of the root domain your mail is sent from.

Not sure what your site is missing? Run a free SiteShield scan to check your email authentication, HTTPS, and security headers in under a minute.

Check your site free