On this page

Fixing SPF in Cloudflare for Microsoft 365

What this fixes

SPF lists which servers are authorized to send mail for your domain. See Fixing SPF Record Issues for what it does and why it matters — this guide gives you the exact record for Microsoft 365 and where to add it in Cloudflare.

The record

v=spf1 include:spf.protection.outlook.com -all

Microsoft recommends -all (hard fail) provided DKIM and DMARC are also configured. If your tenant is in a specific cloud (GCC High/DoD or the China 21Vianet cloud), the include changes:

  • GCC High / DoD: include:spf.protection.office365.us
  • 21Vianet (China): include:spf.protection.partner.outlook.cn

If you send mail through other services too (a CRM, a marketing platform), add their include: mechanisms alongside Microsoft's in the same record — you can only have one SPF TXT record per domain.

How to add it in Cloudflare

  1. Log in to the Cloudflare dashboard and select your domain.
  2. Go to DNS → Records → Add record.
  3. Set Type to TXT.
  4. Name: @ (your root domain).
  5. Content: paste the record above.
  6. Set TTL to Auto.
  7. Click Save.
  8. Re-run your scan to confirm.

If an SPF TXT record already exists, edit it rather than adding a second one — multiple SPF records will cause validation to fail entirely.

Common pitfalls

  • Adding a second v=spf1 TXT record instead of merging into the existing one — SPF only allows one.
  • Using the standard commercial-cloud include when your tenant is actually in GCC High or the China cloud — check which Microsoft 365 environment you're on before copying the record above.