Description
Ensure the domain has a single SPF TXT record, starting with v=spf1, that lists your approved mail servers and ends with -all (hard fail). This tells receiving servers to reject mail from any server that is not listed.
Rationale
Without SPF, anyone can send email that appears to come from your domain. A soft fail (~all) or neutral (?all) policy only marks such mail as suspicious. A strict -all policy clearly tells receivers that unlisted senders are not allowed, which reduces spoofing and phishing using your domain.
Impact
Receivers can reject mail from unauthorized servers
Reduces email spoofing using your domain
Any legitimate sender not listed will fail SPF
Default Value
By default, no SPF record exists.
Pre-Requisites
Cloudflare account with Administrator or DNS permissions for the zone
A list of all services that send email for your domain
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Filter by Type TXT and find the record on the root domain that starts with v=spf1.
Verify that there is only one SPF record and that it ends with -all.
If there is no SPF record, more than one, or it does not end with -all, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Select Add record (or Edit the existing SPF record) with Type TXT and Name @.
Enter the Content, for example: v=spf1 include:_spf.google.com -all (use the include values for your own mail providers).
Select Save.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Select Edit on the SPF record, restore its previous value (for example, ending with ~all), and select Save.
Reference