Skip to main content
New SPF lookups must resolve in milliseconds — why a DMARC tool's add-on isn't enough Learn Why → →

Cloudflare SPF flattening

Cloudflare does not offer native SPF flattening; it serves your TXT record as-is. To flatten, resolve your include: mechanisms to ip4/ip6 addresses, publish a single TXT record in DNS, and use AutoSPF to keep it current.

If your domain uses Cloudflare for DNS, you may be wondering whether Cloudflare can flatten a bloated SPF record for you. The short answer is no: Cloudflare does not offer native SPF flattening. Cloudflare hosts your DNS records and serves them fast across its global network, but it treats your SPF record as an ordinary TXT record and never rewrites include: mechanisms into IP addresses on your behalf.

That matters because SPF has a hard ceiling. Under RFC 7208, an SPF check is capped at 10 DNS mechanism lookups. Every include:, a, mx, ptr, and redirect in your record consumes lookups, and nested includes count too. Cross that limit and receiving servers return PermError — a permanent failure that breaks authentication for every message from your domain, no matter how correct the rest of the record is. SPF flattening is the fix: you replace lookup-heavy include: mechanisms with the resolved ip4: and ip6: addresses, dropping the record back under the limit.

This guide covers whether Cloudflare flattens SPF (it doesn’t), how to flatten a record that lives on Cloudflare DNS, how to publish the flattened TXT record in the Cloudflare dashboard, and how to keep it accurate automatically with AutoSPF.

Does Cloudflare offer native SPF flattening?

No. Cloudflare’s DNS product is authoritative DNS hosting — it publishes exactly the TXT content you enter. It does not parse your SPF record, resolve the includes, or collapse them into IPs. There is no toggle, page rule, or Email Routing setting that performs SPF flattening.

Cloudflare Email Routing forwards inbound mail and adds its own SPF include when you use it to send, but it does not manage or flatten your outbound SPF record. If your v=spf1 string is pushing past 10 lookups, Cloudflare will happily serve the oversized record and let receivers reject it. Flattening is something you have to do yourself, either manually or with a tool, and then publish the result in Cloudflare.

How to flatten an SPF record hosted on Cloudflare DNS

The mechanics of flattening are the same regardless of who hosts your DNS — Cloudflare just happens to be the place you publish the finished record. If you want the full walkthrough, see how to flatten an SPF record. Here is the process in the Cloudflare context:

  1. Inventory your senders. List every service that sends mail as your domain: Google Workspace or Microsoft 365, your marketing platform (Mailchimp, Sendgrid, etc.), your CRM, help desk, and any transactional providers.

  2. Read your current record. In the Cloudflare dashboard, open your domain, go to DNS → Records, and find the TXT record starting with v=spf1. Note every include: it contains.

  3. Resolve each include to its IPs. For each include: mechanism, resolve the SPF record it points to down to the actual ip4: and ip6: ranges. A record like:

    v=spf1 include:_spf.google.com include:mailchimp.com include:sendgrid.net ~all

    might flatten to:

    v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:198.2.128.0/18 ip6:2001:4860:4000::/36 ~all

  4. Keep the qualifier. Preserve your ~all (soft fail) or -all (hard fail) at the end. Flattening changes the mechanisms in the middle, not the policy.

  5. Publish the flattened record back into Cloudflare as a single TXT record (steps below).

The catch: those resolved IPs are not permanent. Providers like Google and Microsoft rotate their sending ranges regularly. A record you flatten by hand today can silently drift out of date next month — mail from the changed IPs starts failing SPF even though your record looks clean. This is the single biggest risk of manual flattening on any DNS host, Cloudflare included. Compare the tradeoffs in best SPF flattening tools.

Adding the flattened TXT record in the Cloudflare dashboard

Once you have your flattened string, publish it in Cloudflare:

  1. Sign in at dash.cloudflare.com and select your domain.
  2. In the left sidebar, click DNS → Records.
  3. If an old v=spf1 TXT record exists, edit it rather than adding a second one — a domain must have exactly one SPF record. Two v=spf1 TXT records cause a PermError and fail authentication.
  4. To add fresh, click Add record and set:
    • Type: TXT
    • Name: @ (this represents your root domain)
    • Content: paste your full flattened v=spf1 … ~all string
    • TTL: leave at Auto
  5. Click Save.

A few Cloudflare-specific notes:

  • Use TXT, not the legacy SPF type. Cloudflare, like modern DNS practice, publishes SPF as a TXT record. The obsolete SPF record type is not used.
  • Proxy status does not apply. SPF is a TXT record, so there is no orange-cloud proxy toggle to worry about — it is always served as authoritative DNS.
  • Watch the 255-character string limit. A single DNS TXT string maxes out at 255 characters. Long flattened records must be split into multiple quoted strings inside one TXT record; Cloudflare handles this concatenation, but keep the record as lean as possible.

After publishing, allow a few minutes for propagation, then confirm the record with our SPF Checker to verify the syntax is valid and you are under the 10-lookup limit.

Using AutoSPF with Cloudflare-hosted domains

Manual flattening solves today’s PermError but reintroduces a maintenance problem: your flattened IPs go stale whenever an upstream provider changes its ranges. AutoSPF’s hosted SPF flattening service closes that gap and works cleanly with Cloudflare DNS.

Here is how AutoSPF fits a Cloudflare setup:

  • You keep one clean SPF record on Cloudflare that points at an AutoSPF-hosted lookup. AutoSPF resolves all your includes behind that single mechanism, so your visible record stays comfortably under 10 lookups.
  • AutoSPF rescans every 15 minutes and automatically updates the flattened result when an upstream provider’s IPs change — so mail from newly-rotated Google or Microsoft ranges keeps passing SPF without you touching Cloudflare again.
  • It resolves to the exact same IPs your includes resolve to — no over-authorization, no guessing, no broad ranges that widen your attack surface. You authorize precisely what your senders use, and nothing more.

Because AutoSPF is DNS-provider agnostic, it doesn’t require any special Cloudflare integration. You publish one record in the Cloudflare dashboard using the same DNS → Records → Add record flow above, and AutoSPF handles the flattening and ongoing maintenance from there.

Flattening also interacts with your wider authentication stack — if you’re wondering whether collapsing includes changes anything for your other records, see does SPF flattening affect DKIM & DMARC. (Short version: it doesn’t; DKIM and DMARC are evaluated independently.)

Frequently Asked Questions

Does Cloudflare flatten SPF records automatically?

No. Cloudflare is an authoritative DNS host — it serves the exact TXT record you enter and never resolves your include: mechanisms into IP addresses. Flattening is something you do yourself or with a dedicated tool like AutoSPF, then publish the result in Cloudflare.

How do I add a flattened SPF record in Cloudflare?

In the Cloudflare dashboard, open your domain and go to DNS → Records. Edit your existing v=spf1 TXT record (or add one with Type TXT, Name @) and paste your flattened v=spf1 … ~all string, then Save. Keep only one SPF record per domain to avoid a PermError.

Why does my Cloudflare SPF record cause a PermError?

Under RFC 7208, SPF checks are capped at 10 DNS lookups. If your record’s include: mechanisms exceed that limit — or if you accidentally publish two v=spf1 records — receivers return PermError and SPF fails for every message. Flattening the record back under 10 lookups resolves it.

Will flattened IP addresses in Cloudflare go out of date?

Yes, if you flatten manually. Providers like Google and Microsoft rotate their sending IP ranges, so a hand-flattened record can silently drift and start failing SPF. AutoSPF avoids this by rescanning every 15 minutes and auto-updating the flattened record whenever upstream IPs change.

Can I use AutoSPF if my DNS is on Cloudflare?

Yes. AutoSPF is DNS-provider agnostic and needs no special Cloudflare integration. You publish one clean SPF record in Cloudflare pointing at AutoSPF, and it handles the flattening, keeps you under the 10-lookup limit, and updates automatically as your senders’ IPs change.

Should SPF be a TXT record or an SPF record in Cloudflare?

Always use the TXT record type. The legacy dedicated SPF record type is obsolete and not used in modern DNS. In Cloudflare, choose Type TXT, Name @, and paste your v=spf1 content.

Rated 5/5 on G2 · Trusted since 2018

Trusted by 50,000+ domains

"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product"

It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.
PJ

Peter J.

President · Small-Business (50 or fewer emp.)

"Helped us go beyond capacity"

AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.
VU

Verified User

Financial Services · Mid-Market (51-1000 emp.)

"Great service and great support"

AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.
GF

Greg F.

Mid-Market (51-1000 emp.)

Read our reviews on G2