How to Add an SPF Record in Cloudflare DNS (2026 Guide)

Cloudflare is DNS-only for most domains, but it also proxies traffic for many records by default - and that single toggle is the reason SPF setups on Cloudflare fail more often than on a plain registrar. Here's the exact process.

Step 1: Add the TXT Record

Cloudflare dashboard → select your domain → DNS → Records → "Add record." Set:

• Type: TXT
• Name: @ (root domain)
• Content: v=spf1 include:_spf.google.com ~all (swap the include for Microsoft 365: include:spf.protection.outlook.com)
• TTL: Auto

Step 2: Ignore the Proxy Toggle - It Doesn't Apply Here

Cloudflare shows an orange/grey cloud proxy toggle next to A and CNAME records - this only routes web traffic through Cloudflare's edge, and Cloudflare doesn't proxy TXT records at all, so there's nothing to switch off for SPF specifically. The actual failure mode is different: if your MX record is accidentally proxied (orange cloud), mail delivery breaks entirely regardless of SPF. Confirm your MX record shows the grey "DNS only" cloud.

Step 3: Check for Duplicate SPF Records

Domains migrated to Cloudflare from another registrar frequently carry over an old SPF TXT record during the DNS import. Filter records by "TXT" and confirm only one contains v=spf1 - merge includes into a single record if you find more than one.

Verify Propagation

Cloudflare's own nameservers typically propagate changes within 1–5 minutes globally. Confirm with an MXToolbox SPF lookup, then send a test email and check for spf=pass in the received headers. Once SPF passes, add DKIM (as a second TXT record, usually at selector._domainkey) and a DMARC record the same way.