Set up or fix SPF records in cPanel, Cloudflare and other DNS providers Print

Quick answer

To update SPF, identify every service sending with the affected envelope-sender domain, obtain its current requirements, and edit that domain's existing SPF TXT policy at the authoritative DNS provider. Keep one SPF policy at that name. Do not add a second v=spf1 record when connecting another sender.

Applies to

Interactive Online email-enabled cPanel services and domains using external senders such as Google Workspace, Microsoft 365, newsletter or website-mail platforms. A dedicated return-path subdomain may need its own policy. SPF is separate from the SMTP password, visible From address and MX records.

1. Collect the current policy and all senders

1. Identify the authoritative DNS provider and the exact domain used for the message's envelope sender. Inspect a controlled message's receiving headers or ask the sending provider which return-path domain it uses.
2. Copy the current TXT policy and TTL before changing it. Other TXT values at the same name may be valid verification records; preserve them.
3. List hosted mailbox mail, website notifications, marketing, CRM and other senders. Obtain each requirement from its administrator. Do not authorize an IP because it appeared in an unsolicited email or report.
4. For mail actually sent by our cPanel service, open Email > Email Deliverability > Manage for that domain and review its suggested SPF value. If delivery uses an external service, get that service's requirement instead. Never assume the website's A-record address is the correct outbound-mail address.

2. Build one valid policy

An SPF policy starts with v=spf1. Authorized IP mechanisms and provider-specified includes belong inside that one policy, before its final qualifier. A demonstration using reserved example addresses might look like this:

v=spf1 ip4:192.0.2.10 include:_spf.example.net ~all

This example does not authorize your real senders and must not be copied into a live zone. Use your providers' actual values. ~all produces a softfail for unmatched sources; -all produces fail. Neither is a universal command forcing every receiver to deliver, quarantine or reject a message. Avoid +all, which authorizes any sender.

SPF evaluation limits DNS-querying mechanisms and modifiers to ten, including nested provider lookups. Ten visible include entries are not a safe allowance if their nested evaluations exceed the limit. Have the email administrator assess the complete policy. Do not manually flatten changing vendor IP lists unless there is a supported process to maintain them.

3. Publish at the correct DNS provider

1. Our cPanel is authoritative: review the available SPF customization in Email Deliverability > Manage, including all legitimate third-party senders, or edit the exact TXT policy through Domains > Zone Editor > Manage. Inspect the preview and save the intended record.
2. Cloudflare is authoritative: select the domain and open DNS > Records. Find the TXT entry beginning v=spf1 at the exact name and choose Edit. Update its content and save. Use Add record > TXT only if no SPF policy exists there. Do not change MX or website proxy settings.
3. Another provider is authoritative: use its TXT editor. The overview below covers GoDaddy, Namecheap, Squarespace and Route 53. Use @ only when that editor uses it for the intended root name. SPF uses TXT; the obsolete separate SPF record type is not needed.
4. Read the saved record back. If cPanel is not authoritative, its local repair alone does not update Cloudflare or another public zone.

4. Verify the public answer and actual sending

These example commands inspect DNS without changing it. Replace the sample domain with the intended envelope-sender domain:

nslookup -type=NS example.com
nslookup -type=TXT example.com

Compare the recursive result with an answer from the authoritative nameserver when troubleshooting caches. One long TXT record can be displayed as several quoted strings; that is different from two separate SPF policies. Recheck after the previous TTL has expired, allowing for the DNS provider's update behavior.

Send a controlled message from each important system. Inspect spf= and smtp.mailfrom= in the trusted receiver's headers. Also inspect DKIM and DMARC alignment. A DNS checker showing a syntactically valid policy does not prove every sender is authorized.

Troubleshoot the actual result

• Multiple SPF records or permerror: preserve the originals, identify valid senders, and replace conflicting policies with one reviewed policy. Also check syntax and the full DNS lookup budget.
• SPF fail or softfail: compare the real sending source and envelope domain with that provider's requirements. Adding unrelated web, Cloudflare or recipient IPs does not fix sender authorization.
• SPF passes but DMARC fails: check alignment between the envelope domain and visible From domain, or configure aligned DKIM at the sender.
• Forwarded mail fails SPF: the forwarding connection may use a different IP. Investigate the forwarding path and DKIM result rather than broadly authorizing other mail systems.
• Temperror: inspect DNS availability and retry after the underlying resolver or authoritative-server issue is resolved.

If an intended change breaks legitimate sending, compare the saved previous policy with current changes before restoring it. Keep the sender inventory and follow up with a supported permanent correction.

When to contact support

Contact Interactive Online if your email-enabled hosting service, cPanel controls, DNS authority or suggested cPanel sender values are unclear. Include the domain, exact error, affected sending service, time and time zone, and redacted authentication results or bounce details. Use a sample screenshot when possible. Keep passwords, cookies, private signing keys and API tokens out of the ticket. For Google Workspace, Microsoft 365 or another sender, obtain that service's current authentication values from its administrator. We can help identify the hosting side; access to your external DNS or email account is separate.

Related help

• Understand SPF, DKIM and DMARC
• Enable and verify DKIM signing
• Review DMARC alignment and policy
• Website form sender setup
• Find your active DNS provider

Official references

• SPF specification and DNS evaluation limits
• Google Workspace SPF sender inventory
• Microsoft 365 SPF setup
• cPanel SPF suggestion and customization
• Cloudflare mail-related records

Content and primary-source review by Interactive Online: November 2, 2026. Provider documentation and applicable standards were reviewed. DNS records, signing keys and mail settings were not changed for this article. Menu names and available controls depend on your account, theme and permissions.