Publish an SPF record on Cloudflare

email.spf.missing · effort: about an hour

Why it matters

SPF is the list of servers allowed to send mail as your domain; without it anyone can send mail that claims to come from you and receivers have nothing to check it against. Publishing it also lets receivers judge your real mail more confidently.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

In the Cloudflare dashboard select the domain, then open DNS > Records and choose Add record.
Set Type to TXT, Name to the domain (or @ for the zone apex), and paste the SPF text from the snippet as Content, replacing the example include with your provider's. Cloudflare adds the quotes itself.
Leave TTL on Auto and save. TXT records cannot be proxied, so there is no orange cloud to worry about.
Check the zone has no other TXT record starting with v=spf1; if it does, merge the two into one record. Start with ~all, tighten to -all only after every sender is confirmed.
For a domain that sends no mail use the content v=spf1 -all. Only if no mailbox uses this domain, you can also add a null MX: Type MX, Name @, Mail server . (a single dot), Priority 0. If the dashboard rejects the dot, skip the null MX; SPF -all and DMARC p=reject are what stop spoofing.

text

Type:     TXT
Name:     example.com
Content:  v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all
TTL:      Auto

# Domain that sends no mail, Content:
# v=spf1 -all
# Only if no mailbox uses this domain, optional null MX:
# Type: MX   Name: @   Mail server: .   Priority: 0

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related