Skip to main content
spf PROTOCOLHost: Cloudflare DNSStandard: RFC 7208

How to Configure Sender Policy Framework (SPF) on Cloudflare DNS

Specifies which IP addresses and email service providers are authorized to send email on behalf of your domain. Follow this verified implementation guide to deploy standard compliant SPF DNS records in Cloudflare DNS.

Default SPF Record Syntax

// Authoritative RFC Example
v=spf1 include:_spf.example.com ~all

Configuration Steps in Cloudflare DNS

  1. 1Log in to the Cloudflare Dashboard and select your domain.
  2. 2Navigate to the "DNS" -> "Records" management panel.
  3. 3Locate the dangling CNAME/record for the orphaned subdomain.
  4. 4Click "Edit" and either update the target to an active resource or click "Delete" to remove it.
  5. 5Verify that Cloudflare Proxy (Orange Cloud) is enabled if HTTP proxying is required.

Verification Checklist (RFC 7208)

Extract TXT records on the root domain looking for "v=spf1".
Verify that there is strictly ONE SPF record (multiple records cause PermError).
Count total DNS lookups (RFC 7208 strictly limits recursive DNS evaluations to 10).
Ensure the record ends with "~all" (SoftFail) or "-all" (HardFail).
Live Validation Engine

Validate Your Cloudflare DNS SPF Record

Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.

Run Free DNS Validator