webzod
account

Choose the right SPF ending for this domain on Cloudflare

email.spf.softfail_all · effort: minutes

Why it matters

A domain that sends no mail should publish -all so spoofed mail claiming to come from it is rejected outright. A domain that does send mail can keep ~all while DMARC enforces; -all is the stricter option once every sender is listed.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. In the Cloudflare dashboard open DNS > Records and edit the SPF TXT record.
  2. For a domain that sends no mail set Content to v=spf1 -all. For a mail-sending domain only change ~all to -all once DMARC reports are clean.
  3. Only if no mailbox uses this domain, you can also add a null MX: Type MX, Name @, Mail server . (a single dot), Priority 0. If the dashboard rejects the dot, skip the null MX; SPF -all and DMARC p=reject are what stop spoofing.
text 
Type:     TXT
Name:     example.com
Content:  v=spf1 -all

# Only if no mailbox uses this domain, optional null MX:
# Type: MX   Name: @   Mail server: .   Priority: 0

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.