Bring the SPF record under 10 DNS lookups on Cloudflare

Why it matters

SPF allows at most 10 DNS lookups across the record and everything it includes, and beyond that receivers return a permanent error, so SPF fails for every sender. This is easy to hit when several mail services each add their own include.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records and edit the SPF TXT record to drop includes you no longer use.
2. To split senders onto a subdomain, use Add record: Type TXT, Name set to the subdomain (for example news), Content a separate v=spf1 record for the services that send from it.
3. Cloudflare does not flatten SPF for you; if you copy a provider's IP list into the record by hand, it will go out of date.

Type:     TXT
Name:     news.example.com
Content:  v=spf1 include:_spf.MARKETING-PROVIDER.example ~all

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Fix the syntax error in the SPF record
• Replace +all in the SPF record with ~all
• Narrow the very large address range in the SPF record
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read