Incorrect Security Insights on SPF Record

Website, Application, Performance Security Center
1

What is the name of the domain?

pollsnap.app

What is the error message?

SPF Record Errors

What is the issue you’re encountering

Security Insights says No SPF record detected for my domain pollsnap.app and notify.pollsnap.app, but Email → DMARC Management → View records → SPF → Inspect shows the SPF records for these domains are good, as well as the other online SPF checkers.

Screenshot of the error

Screenshot 2025-02-10 at 21.09.01.png
Screenshot 2025-02-10 at 21.09.01.png1440×1202 88 KB

2

One potential cause and fix might be Security Insights says SPF record incorrect - #6 by asi, however,

  • Changing “~all” to “-all” doesn’t apply to all the customer use cases, and if this is the root cause, the security insight message could be improved.
  • Removing double quotes before v=spf1 is not a viable solution. I tried that in DNS → Record, but Cloudflare adds the quote back after saving.

Or this might be a bug (false positive alert or at least unclear message) on the Security Insights.

3

We see the same (low) warning for all our domains as soon as the SPF TXT record contains an “include:…”. With

“v=spf1 mx include:sendgrid.net -all”

we get the message No SPF record detected/We detect an incorrect or missing SPF record for the insights type “Email security”.

On the other hand, with

“v=spf1 mx -all”

after a new scan, everything is fine again. Unfortunately, we don’t really know what Cloudflare checks in the background and how Cloudflare determines if this is a real (minor) problem or if the SPF record is “incorrect”. However, from our point of view, an “include:” as required by us should not lead to a warning or the detected “problem” should be described in more detail. In any case, the currently displayed information is not very helpful.