On this page

Fixing SPF in Cloudflare for Google Workspace

What this fixes

SPF lists which servers are authorized to send mail for your domain. See Fixing SPF Record Issues for what it does and why it matters — this guide gives you the exact record for Google Workspace and where to add it in Cloudflare.

The record

v=spf1 include:_spf.google.com ~all

Google's own guidance recommends ~all (soft fail) rather than -all. If you send mail through other services too (a CRM, a marketing platform), add their include: mechanisms alongside Google's in the same record — you can only have one SPF TXT record per domain.

How to add it in Cloudflare

  1. Log in to the Cloudflare dashboard and select your domain.
  2. Go to DNS → Records → Add record.
  3. Set Type to TXT.
  4. Name: @ (your root domain).
  5. Content: paste the record above.
  6. Set TTL to Auto.
  7. Click Save.
  8. Re-run your scan to confirm.

If an SPF TXT record already exists, edit it rather than adding a second one — multiple SPF records will cause validation to fail entirely.

Common pitfalls

  • Adding a second v=spf1 TXT record instead of merging into the existing one — SPF only allows one.
  • Using -all when you're not fully confident every legitimate sender is included — ~all gives you a softer landing while you verify.