From 1b7eed7fbc26bd9dade4267ad82f6d19f213f739 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 20:20:18 +0000 Subject: [PATCH 01/13] [Email] add Google Workspace MX conflict guidance to troubleshooting DEE-3619 --- .../email-service/reference/troubleshooting.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 0521522fd3e..9b49f21592d 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -211,6 +211,23 @@ Different ISPs have specific requirements: - Yahoo: Strict DMARC enforcement - Corporate: Often have strict filtering rules + +## Conflicts with external mail providers + +### Google Workspace MX conflict + +Cloudflare Email Routing (inbound) and Google Workspace cannot be active simultaneously on the same domain. Both services require control of your domain's MX records, and only one set can be authoritative at a time. If both are configured, email delivery will be unpredictable. + +**To switch to Google Workspace for inbound email:** + +1. In the Cloudflare dashboard, go to **Email** > **Email Routing** and select your domain. +2. Disable Email Routing. Cloudflare removes the Cloudflare MX records automatically. +3. Add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. + +**To keep Email Routing while also using Google Workspace:** + +Email Routing on the root domain and Google Workspace MX records are mutually exclusive. However, you can run Email Routing on a subdomain (for example, `notifications.example.com`) while Google Workspace handles email for the root domain. Refer to [subdomains](/email-service/configuration/subdomains/) for setup details. + ## Testing tools Use these tools to validate your email authentication setup: From 4e2bb2c555e70c528f59ce4b468fe8637d9a1202 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 20:50:18 +0000 Subject: [PATCH 02/13] [Email] fix nav path and step order for Google Workspace MX switch DEE-3619 --- .../email-service/reference/troubleshooting.mdx | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 9b49f21592d..0f68f72b759 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -220,9 +220,16 @@ Cloudflare Email Routing (inbound) and Google Workspace cannot be active simulta **To switch to Google Workspace for inbound email:** -1. In the Cloudflare dashboard, go to **Email** > **Email Routing** and select your domain. -2. Disable Email Routing. Cloudflare removes the Cloudflare MX records automatically. -3. Add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. +Email Routing locks its MX and SPF records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before disabling Email Routing. + +1. Go to **Compute** > **Email Service** > **Email Routing**. + + + +2. Select your domain, then open **Settings**. +3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). +4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. +5. Return to **Compute** > **Email Service** > **Email Routing** and disable Email Routing. Cloudflare removes its routing records automatically. **To keep Email Routing while also using Google Workspace:** From 2574b17b37ff139308b3b6a042837030f590048b Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 21:18:37 +0000 Subject: [PATCH 03/13] [Email] replace disable/disabling with turn off for Email Routing toggle DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 0f68f72b759..59fd1687955 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -220,7 +220,7 @@ Cloudflare Email Routing (inbound) and Google Workspace cannot be active simulta **To switch to Google Workspace for inbound email:** -Email Routing locks its MX and SPF records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before disabling Email Routing. +Email Routing locks its MX and SPF records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before turning off Email Routing. 1. Go to **Compute** > **Email Service** > **Email Routing**. @@ -229,7 +229,7 @@ Email Routing locks its MX and SPF records by default to prevent accidental chan 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. Return to **Compute** > **Email Service** > **Email Routing** and disable Email Routing. Cloudflare removes its routing records automatically. +5. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing records automatically. **To keep Email Routing while also using Google Workspace:** From 3d52356d5e5d385badaef9e32f5a5a77027b0fcf Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 21:45:14 +0000 Subject: [PATCH 04/13] [Email] add SPF replacement step and monospace DNS record types DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 59fd1687955..c66e9253722 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -220,7 +220,7 @@ Cloudflare Email Routing (inbound) and Google Workspace cannot be active simulta **To switch to Google Workspace for inbound email:** -Email Routing locks its MX and SPF records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before turning off Email Routing. +Email Routing locks its `MX` and `SPF` records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before turning off Email Routing. 1. Go to **Compute** > **Email Service** > **Email Routing**. @@ -229,7 +229,8 @@ Email Routing locks its MX and SPF records by default to prevent accidental chan 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing records automatically. +5. In **DNS** > **Records**, update the SPF `TXT` record on the root domain to authorize Google's mail servers. Replace the Cloudflare-only value with `v=spf1 include:_spf.google.com ~all`. If you send from other services, merge all senders into a single SPF record. +6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing `MX`, `SPF`, and `DKIM` records automatically — your updated SPF record will remain. **To keep Email Routing while also using Google Workspace:** From 26f4ac9cb6170464ebad77528df69e2607ad3097 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 22:19:27 +0000 Subject: [PATCH 05/13] [Email] fix SPF merge order and acknowledge MX propagation overlap DEE-3619 --- .../docs/email-service/reference/troubleshooting.mdx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index c66e9253722..34a2941ba7c 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -220,7 +220,7 @@ Cloudflare Email Routing (inbound) and Google Workspace cannot be active simulta **To switch to Google Workspace for inbound email:** -Email Routing locks its `MX` and `SPF` records by default to prevent accidental changes. To switch providers without interrupting mail, unlock the records first, then add the Google Workspace records alongside them before turning off Email Routing. +Email Routing locks its `MX` and `SPF` records by default to prevent accidental changes. To minimize mail disruption, unlock the records first, add the Google Workspace records alongside them, and complete all steps as quickly as possible. During DNS propagation, mail may be temporarily split between the two paths. 1. Go to **Compute** > **Email Service** > **Email Routing**. @@ -229,8 +229,9 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. In **DNS** > **Records**, update the SPF `TXT` record on the root domain to authorize Google's mail servers. Replace the Cloudflare-only value with `v=spf1 include:_spf.google.com ~all`. If you send from other services, merge all senders into a single SPF record. -6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing `MX`, `SPF`, and `DKIM` records automatically — your updated SPF record will remain. +5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This ensures forwarded mail continues to pass `SPF` checks during the transition. If you send from other services, add their includes to the same record. +6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing `MX`, `SPF`, and `DKIM` records automatically. +7. In **DNS** > **Records**, update the `SPF` `TXT` record to remove the Cloudflare include: `v=spf1 include:_spf.google.com ~all`. **To keep Email Routing while also using Google Workspace:** From 06300660fe7492a50ecaae8fbacf72c25d6a0350 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 22:48:25 +0000 Subject: [PATCH 06/13] [Email] add SPF lookup-limit caveat and clarify locked vs unlocked record behavior DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 34a2941ba7c..b9e0bfa273b 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -229,8 +229,8 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This ensures forwarded mail continues to pass `SPF` checks during the transition. If you send from other services, add their includes to the same record. -6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes its routing `MX`, `SPF`, and `DKIM` records automatically. +5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#spf-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. +6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes the routing records it still manages (`MX` and `DKIM`). Your unlocked and edited `SPF` record remains in place. 7. In **DNS** > **Records**, update the `SPF` `TXT` record to remove the Cloudflare include: `v=spf1 include:_spf.google.com ~all`. **To keep Email Routing while also using Google Workspace:** From 0476d4b6573b48f2bd5b3d0c173371c9f9e22599 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 23:18:54 +0000 Subject: [PATCH 07/13] [Email] fix broken anchor link and align SPF removal with domains.mdx behavior DEE-3619 --- .../docs/email-service/reference/troubleshooting.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index b9e0bfa273b..2d914dac3b6 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -229,9 +229,9 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#spf-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. -6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes the routing records it still manages (`MX` and `DKIM`). Your unlocked and edited `SPF` record remains in place. -7. In **DNS** > **Records**, update the `SPF` `TXT` record to remove the Cloudflare include: `v=spf1 include:_spf.google.com ~all`. +5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#remove-a-domain-from-email-routing). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. +6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). +7. In **DNS** > **Records**, add a new `SPF` `TXT` record on the root domain: `v=spf1 include:_spf.google.com ~all`. **To keep Email Routing while also using Google Workspace:** From 695c8df41156c8bc0c95ed700ccdb9aab3e10a29 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Mon, 7 Sep 2026 23:48:14 +0000 Subject: [PATCH 08/13] [Email] fix duplicate SPF risk and correct 10-lookup-limit anchor link DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 2d914dac3b6..2a8fcc4f1af 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -229,9 +229,9 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 2. Select your domain, then open **Settings**. 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#remove-a-domain-from-email-routing). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. +5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. 6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). -7. In **DNS** > **Records**, add a new `SPF` `TXT` record on the root domain: `v=spf1 include:_spf.google.com ~all`. +7. In **DNS** > **Records**, update the existing `SPF` `TXT` record on the root domain to remove the Cloudflare include: `v=spf1 include:_spf.google.com ~all`. **To keep Email Routing while also using Google Workspace:** From faa6caea47b35af6d7828c4c3134b22a42c87aeb Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Tue, 8 Sep 2026 08:45:31 +0000 Subject: [PATCH 09/13] [Email] fix step 7 to add new SPF record, not update non-existent one DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 2a8fcc4f1af..50b5397eea1 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -231,7 +231,7 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. 5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. 6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). -7. In **DNS** > **Records**, update the existing `SPF` `TXT` record on the root domain to remove the Cloudflare include: `v=spf1 include:_spf.google.com ~all`. +7. In **DNS** > **Records**, add a new `SPF` `TXT` record on the root domain: `v=spf1 include:_spf.google.com ~all`. **To keep Email Routing while also using Google Workspace:** From 84d00d4cebb417fe897d43f0e43a92836f8f7cb8 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Tue, 8 Sep 2026 10:00:54 +0000 Subject: [PATCH 10/13] [Email] prevent duplicate SPF on step 7 by checking before adding DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 50b5397eea1..2331ad9751f 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -231,7 +231,7 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. 5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. 6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). -7. In **DNS** > **Records**, add a new `SPF` `TXT` record on the root domain: `v=spf1 include:_spf.google.com ~all`. +7. In **DNS** > **Records**, check whether a `v=spf1` `TXT` record still exists on the root domain. If one remains, update it to: `v=spf1 include:_spf.google.com ~all`. If none exists, add a new `TXT` record with that value. **To keep Email Routing while also using Google Workspace:** From 8572cdf1b68bb36fb4ec918b914283b7da18cc9c Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Tue, 8 Sep 2026 12:01:14 +0000 Subject: [PATCH 11/13] [Email] step 7: remove only Cloudflare SPF include, preserve other senders DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 2331ad9751f..18c507799eb 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -231,7 +231,7 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. 5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. 6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). -7. In **DNS** > **Records**, check whether a `v=spf1` `TXT` record still exists on the root domain. If one remains, update it to: `v=spf1 include:_spf.google.com ~all`. If none exists, add a new `TXT` record with that value. +7. In **DNS** > **Records**, update your `SPF` `TXT` record on the root domain: remove the `include:_spf.mx.cloudflare.net` mechanism and confirm `include:_spf.google.com` is present. Keep any other existing `include:` entries for other services you send from. The resulting record should look similar to `v=spf1 include:_spf.google.com ~all` (plus any additional services). **To keep Email Routing while also using Google Workspace:** From ffec60841e983d729813c530b9cccb7dc7f5492c Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Tue, 8 Sep 2026 14:01:26 +0000 Subject: [PATCH 12/13] [Email] clarify step 6: Email Routing only removes MX/DKIM, unlocked SPF survives DEE-3619 --- src/content/docs/email-service/reference/troubleshooting.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 18c507799eb..03a29cf6db1 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -230,7 +230,7 @@ Email Routing locks its `MX` and `SPF` records by default to prevent accidental 3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). 4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. 5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. -6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes all routing-related DNS records it added to the root domain (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). +6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes the routing DNS records it still manages — `MX` and `DKIM`. Because you unlocked and edited the `SPF` record in steps 3 and 5, Email Routing no longer manages it; that record remains in place. Refer to [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing) for details. 7. In **DNS** > **Records**, update your `SPF` `TXT` record on the root domain: remove the `include:_spf.mx.cloudflare.net` mechanism and confirm `include:_spf.google.com` is present. Keep any other existing `include:` entries for other services you send from. The resulting record should look similar to `v=spf1 include:_spf.google.com ~all` (plus any additional services). **To keep Email Routing while also using Google Workspace:** From 86590adee1a058be7b0b68e43ca464a17f9c3e55 Mon Sep 17 00:00:00 2001 From: Nicolas Gayerie Date: Tue, 8 Sep 2026 16:03:26 +0000 Subject: [PATCH 13/13] [Email] simplify GW switch procedure: remove unlock steps, clean 4-step flow DEE-3619 --- .../email-service/reference/troubleshooting.mdx | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/src/content/docs/email-service/reference/troubleshooting.mdx b/src/content/docs/email-service/reference/troubleshooting.mdx index 03a29cf6db1..eee93fcc837 100644 --- a/src/content/docs/email-service/reference/troubleshooting.mdx +++ b/src/content/docs/email-service/reference/troubleshooting.mdx @@ -220,18 +220,15 @@ Cloudflare Email Routing (inbound) and Google Workspace cannot be active simulta **To switch to Google Workspace for inbound email:** -Email Routing locks its `MX` and `SPF` records by default to prevent accidental changes. To minimize mail disruption, unlock the records first, add the Google Workspace records alongside them, and complete all steps as quickly as possible. During DNS propagation, mail may be temporarily split between the two paths. +Complete the following steps quickly to minimize the time during which both sets of `MX` records are active. -1. Go to **Compute** > **Email Service** > **Email Routing**. +1. In **DNS** > **Records**, add the five Google Workspace `MX` records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. The Cloudflare Email Routing `MX` records remain active until the next step. +2. Return to **Compute** > **Email Service** > **Email Routing**. -2. Select your domain, then open **Settings**. -3. In the **DNS records** section, select **Unlock** for each locked record (MX and SPF). -4. Go to **DNS** > **Records** and add the five Google Workspace MX records. Refer to [Set up Google Workspace DNS records](/dns/manage-dns-records/how-to/set-up-google-workspace/) for the complete record values. -5. In **DNS** > **Records**, update the `SPF` `TXT` record on the root domain to merge both providers while Email Routing is still active: `v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all`. This helps forwarded mail pass `SPF` checks during the transition, provided the merged record stays within the [10 DNS lookup limit](/email-service/configuration/domains/#routing-records). If merging pushes you over the limit, consider flattening the record or removing non-essential `include:` entries. -6. Return to **Compute** > **Email Service** > **Email Routing** and turn off Email Routing. Cloudflare removes the routing DNS records it still manages — `MX` and `DKIM`. Because you unlocked and edited the `SPF` record in steps 3 and 5, Email Routing no longer manages it; that record remains in place. Refer to [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing) for details. -7. In **DNS** > **Records**, update your `SPF` `TXT` record on the root domain: remove the `include:_spf.mx.cloudflare.net` mechanism and confirm `include:_spf.google.com` is present. Keep any other existing `include:` entries for other services you send from. The resulting record should look similar to `v=spf1 include:_spf.google.com ~all` (plus any additional services). +3. Select your domain, then open **Settings** and turn off Email Routing. Cloudflare removes all routing-related DNS records it manages (`MX`, `SPF`, and `DKIM`), as described in [Remove a domain from Email Routing](/email-service/configuration/domains/#remove-a-domain-from-email-routing). +4. In **DNS** > **Records**, add a new `SPF` `TXT` record on the root domain. If you only send email through Google Workspace, use `v=spf1 include:_spf.google.com ~all`. If you send from other services, include them in the same record. Do not add more than one `SPF` record — having multiple `v=spf1` records on the same domain breaks `SPF` authentication. **To keep Email Routing while also using Google Workspace:**