---
title: "Cloudflare SPF Flattening: How to Flatten & Publish | AutoSPF"
description: "Cloudflare doesn"
image: "https://autospf.com/images/og-default.png"
canonical: "https://autospf.com/spf-flattening/cloudflare-spf-flattening/"
---

# Cloudflare SPF flattening

Cloudflare does not offer native SPF flattening; it serves your TXT record as-is. To flatten, resolve your include: mechanisms to ip4/ip6 addresses, publish a single TXT record in DNS, and use AutoSPF to keep it current.

If your domain uses Cloudflare for DNS, you may be wondering whether Cloudflare can flatten a bloated SPF record for you. The short answer is no: Cloudflare does not offer native SPF flattening. Cloudflare hosts your DNS records and serves them fast across its global network, but it treats your SPF record as an ordinary TXT record and never rewrites `include:` mechanisms into IP addresses on your behalf.

That matters because SPF has a hard ceiling. Under [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208), an SPF check is capped at 10 DNS mechanism lookups. Every `include:`, `a`, `mx`, `ptr`, and `redirect` in your record consumes lookups, and nested includes count too. Cross that limit and receiving servers return `PermError` — a permanent failure that breaks authentication for every message from your domain, no matter how correct the rest of the record is. [SPF flattening](/spf-flattening/) is the fix: you replace lookup-heavy `include:` mechanisms with the resolved `ip4:` and `ip6:` addresses, dropping the record back under the limit.

This guide covers whether Cloudflare flattens SPF (it doesn’t), how to flatten a record that lives on Cloudflare DNS, how to publish the flattened TXT record in the Cloudflare dashboard, and how to keep it accurate automatically with AutoSPF.

## Does Cloudflare offer native SPF flattening?

No. Cloudflare’s DNS product is authoritative DNS hosting — it publishes exactly the TXT content you enter. It does not parse your SPF record, resolve the includes, or collapse them into IPs. There is no toggle, page rule, or Email Routing setting that performs SPF flattening.

Cloudflare Email Routing forwards inbound mail and adds its own SPF include when you use it to send, but it does not manage or flatten your outbound SPF record. If your `v=spf1` string is pushing past 10 lookups, Cloudflare will happily serve the oversized record and let receivers reject it. Flattening is something you have to do yourself, either manually or with a tool, and then publish the result in Cloudflare.

## How to flatten an SPF record hosted on Cloudflare DNS

The mechanics of flattening are the same regardless of who hosts your DNS — Cloudflare just happens to be the place you publish the finished record. If you want the full walkthrough, see [how to flatten an SPF record](/spf-flattening/how-to-flatten-an-spf-record/). Here is the process in the Cloudflare context:

1. **Inventory your senders.** List every service that sends mail as your domain: Google Workspace or Microsoft 365, your marketing platform (Mailchimp, Sendgrid, etc.), your CRM, help desk, and any transactional providers.
2. **Read your current record.** In the Cloudflare dashboard, open your domain, go to **DNS → Records**, and find the TXT record starting with `v=spf1`. Note every `include:` it contains.
3. **Resolve each include to its IPs.** For each `include:` mechanism, resolve the SPF record it points to down to the actual `ip4:` and `ip6:` ranges. A record like:  
```  
v=spf1 include:_spf.google.com include:mailchimp.com include:sendgrid.net ~all  
```  
might flatten to:  
```  
v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:198.2.128.0/18 ip6:2001:4860:4000::/36 ~all  
```
4. **Keep the qualifier.** Preserve your `~all` (soft fail) or `-all` (hard fail) at the end. Flattening changes the mechanisms in the middle, not the policy.
5. **Publish the flattened record** back into Cloudflare as a single TXT record (steps below).

The catch: those resolved IPs are not permanent. Providers like Google and Microsoft rotate their sending ranges regularly. A record you flatten by hand today can silently drift out of date next month — mail from the changed IPs starts failing SPF even though your record looks clean. This is the single biggest risk of manual flattening on any DNS host, Cloudflare included. Compare the tradeoffs in [best SPF flattening tools](/spf-flattening/best-spf-flattening-tools/).

## Adding the flattened TXT record in the Cloudflare dashboard

Once you have your flattened string, publish it in Cloudflare:

1. Sign in at [dash.cloudflare.com](https://dash.cloudflare.com) and select your domain.
2. In the left sidebar, click **DNS → Records**.
3. If an old `v=spf1` TXT record exists, **edit it** rather than adding a second one — a domain must have exactly one SPF record. Two `v=spf1` TXT records cause a `PermError` and fail authentication.
4. To add fresh, click **Add record** and set:  
   - **Type:** `TXT`  
   - **Name:** `@` (this represents your root domain)  
   - **Content:** paste your full flattened `v=spf1 … ~all` string  
   - **TTL:** leave at **Auto**
5. Click **Save**.

A few Cloudflare-specific notes:

- **Use TXT, not the legacy SPF type.** Cloudflare, like modern DNS practice, publishes SPF as a `TXT` record. The obsolete `SPF` record type is not used.
- **Proxy status does not apply.** SPF is a TXT record, so there is no orange-cloud proxy toggle to worry about — it is always served as authoritative DNS.
- **Watch the 255-character string limit.** A single DNS TXT string maxes out at 255 characters. Long flattened records must be split into multiple quoted strings inside one TXT record; Cloudflare handles this concatenation, but keep the record as lean as possible.

After publishing, allow a few minutes for propagation, then confirm the record with our [SPF Checker](/tools/spf-checker/) to verify the syntax is valid and you are under the 10-lookup limit.

## Using AutoSPF with Cloudflare-hosted domains

Manual flattening solves today’s `PermError` but reintroduces a maintenance problem: your flattened IPs go stale whenever an upstream provider changes its ranges. [AutoSPF’s hosted SPF flattening service](/) closes that gap and works cleanly with Cloudflare DNS.

Here is how AutoSPF fits a Cloudflare setup:

- **You keep one clean SPF record** on Cloudflare that points at an AutoSPF-hosted lookup. AutoSPF resolves all your includes behind that single mechanism, so your visible record stays comfortably under 10 lookups.
- **AutoSPF rescans every 15 minutes** and automatically updates the flattened result when an upstream provider’s IPs change — so mail from newly-rotated Google or Microsoft ranges keeps passing SPF without you touching Cloudflare again.
- **It resolves to the exact same IPs your includes resolve to** — no over-authorization, no guessing, no broad ranges that widen your attack surface. You authorize precisely what your senders use, and nothing more.

Because AutoSPF is DNS-provider agnostic, it doesn’t require any special Cloudflare integration. You publish one record in the Cloudflare dashboard using the same **DNS → Records → Add record** flow above, and AutoSPF handles the flattening and ongoing maintenance from there.

Flattening also interacts with your wider authentication stack — if you’re wondering whether collapsing includes changes anything for your other records, see [does SPF flattening affect DKIM & DMARC](/spf-flattening/does-spf-flattening-affect-dkim-dmarc/). (Short version: it doesn’t; DKIM and DMARC are evaluated independently.)

## Frequently Asked Questions

### Does Cloudflare flatten SPF records automatically?

No. Cloudflare is an authoritative DNS host — it serves the exact TXT record you enter and never resolves your `include:` mechanisms into IP addresses. Flattening is something you do yourself or with a dedicated tool like AutoSPF, then publish the result in Cloudflare.

### How do I add a flattened SPF record in Cloudflare?

In the Cloudflare dashboard, open your domain and go to **DNS → Records**. Edit your existing `v=spf1` TXT record (or add one with Type `TXT`, Name `@`) and paste your flattened `v=spf1 … ~all` string, then Save. Keep only one SPF record per domain to avoid a `PermError`.

### Why does my Cloudflare SPF record cause a PermError?

Under RFC 7208, SPF checks are capped at 10 DNS lookups. If your record’s `include:` mechanisms exceed that limit — or if you accidentally publish two `v=spf1` records — receivers return `PermError` and SPF fails for every message. Flattening the record back under 10 lookups resolves it.

### Will flattened IP addresses in Cloudflare go out of date?

Yes, if you flatten manually. Providers like Google and Microsoft rotate their sending IP ranges, so a hand-flattened record can silently drift and start failing SPF. AutoSPF avoids this by rescanning every 15 minutes and auto-updating the flattened record whenever upstream IPs change.

### Can I use AutoSPF if my DNS is on Cloudflare?

Yes. AutoSPF is DNS-provider agnostic and needs no special Cloudflare integration. You publish one clean SPF record in Cloudflare pointing at AutoSPF, and it handles the flattening, keeps you under the 10-lookup limit, and updates automatically as your senders’ IPs change.

### Should SPF be a TXT record or an SPF record in Cloudflare?

Always use the `TXT` record type. The legacy dedicated `SPF` record type is obsolete and not used in modern DNS. In Cloudflare, choose Type `TXT`, Name `@`, and paste your `v=spf1` content.

Rated 5/5 on G2 · Trusted since 2018 

##  Trusted by 50,000+ domains 

### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product"

> It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. 

 PJ 

Peter J.

 President · Small-Business (50 or fewer emp.) 

### "Helped us go beyond capacity"

> AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. 

 VU 

Verified User

 Financial Services · Mid-Market (51-1000 emp.) 

### "Great service and great support"

> AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup. 

 GF 

Greg F.

 Mid-Market (51-1000 emp.) 

[Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does Cloudflare flatten SPF records automatically?","acceptedAnswer":{"@type":"Answer","text":"No. Cloudflare is an authoritative DNS host — it serves the exact TXT record you enter and never resolves your `include:` mechanisms into IP addresses. Flattening is something you do yourself or with a dedicated tool like AutoSPF, then publish the result in Cloudflare."}},{"@type":"Question","name":"How do I add a flattened SPF record in Cloudflare?","acceptedAnswer":{"@type":"Answer","text":"In the Cloudflare dashboard, open your domain and go to DNS → Records. Edit your existing `v=spf1` TXT record (or add one with Type `TXT`, Name `@`) and paste your flattened `v=spf1 … ~all` string, then Save. Keep only one SPF record per domain to avoid a `PermError`."}},{"@type":"Question","name":"Why does my Cloudflare SPF record cause a PermError?","acceptedAnswer":{"@type":"Answer","text":"Under RFC 7208, SPF checks are capped at 10 DNS lookups. If your record's `include:` mechanisms exceed that limit — or if you accidentally publish two `v=spf1` records — receivers return `PermError` and SPF fails for every message. Flattening the record back under 10 lookups resolves it."}},{"@type":"Question","name":"Will flattened IP addresses in Cloudflare go out of date?","acceptedAnswer":{"@type":"Answer","text":"Yes, if you flatten manually. Providers like Google and Microsoft rotate their sending IP ranges, so a hand-flattened record can silently drift and start failing SPF. AutoSPF avoids this by rescanning every 15 minutes and auto-updating the flattened record whenever upstream IPs change."}},{"@type":"Question","name":"Can I use AutoSPF if my DNS is on Cloudflare?","acceptedAnswer":{"@type":"Answer","text":"Yes. AutoSPF is DNS-provider agnostic and needs no special Cloudflare integration. You publish one clean SPF record in Cloudflare pointing at AutoSPF, and it handles the flattening, keeps you under the 10-lookup limit, and updates automatically as your senders' IPs change."}},{"@type":"Question","name":"Should SPF be a TXT record or an SPF record in Cloudflare?","acceptedAnswer":{"@type":"Answer","text":"Always use the `TXT` record type. The legacy dedicated `SPF` record type is obsolete and not used in modern DNS. In Cloudflare, choose Type `TXT`, Name `@`, and paste your `v=spf1` content."}}]}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"SPF Flattening","item":"https://autospf.com/spf-flattening/"},{"@type":"ListItem","position":3,"name":"Cloudflare","item":"https://autospf.com/spf-flattening/cloudflare-spf-flattening/"}]}
```

```json
{"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Greg F."},"datePublished":"2023-07-26","reviewBody":"AutoSPF was easy to initially set up on our own and a great cost effective entry into spf flattening. Needed our first support assistance today and got great response including a video demonstrating the issue I was trying to solve, a quick fix, and more detailed followup.","name":"Great service and great support","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]}
```