Check ID: zone_record_spf_exists
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: email-security
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for SPF (Sender Policy Framework) records by checking if a TXT record exists that specifies which mail servers are authorized to send email on behalf of the domain, and verifies that the record uses a strict policy (-all) to reject unauthorized senders.

​
Risk

Without SPF or with a permissive policy (~all, ?all, +all), attackers can forge emails from your domain. Phishing attacks can harvest sensitive information from recipients who trust spoofed emails. Brand reputation is damaged by fraudulent emails. ~all only marks emails as suspicious without rejecting them.

​
Recommendation

Configure SPF records with strict policy (-all) listing authorized mail servers.
  • SPF records start with v=spf1 and define authorized senders
  • Use -all (hardfail) to reject emails from unauthorized servers
  • Avoid ~all (softfail) in production as it only marks suspicious emails but does not reject them
  • Use include: to authorize third-party mail services
  • Combine with DKIM and DMARC for comprehensive email authentication
  • Test SPF records using online validators before deployment

​
Remediation

# Create SPF record for email authentication with strict policy
resource "cloudflare_record" "spf" {
  zone_id = "<ZONE_ID>"
  name    = "@"
  type    = "TXT"
  content = "v=spf1 include:_spf.google.com -all" # Use -all for strict enforcement
  ttl     = 3600
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_record_spf_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks