diff --git a/pkg/txtutil/txtcode_test.go b/pkg/txtutil/txtcode_test.go
index 6fd4c8955..8b21044de 100644
--- a/pkg/txtutil/txtcode_test.go
+++ b/pkg/txtutil/txtcode_test.go
@@ -84,6 +84,8 @@ func TestTxtEncode(t *testing.T) {
 		data     []string
 		expected string
 	}{
+		{[]string{"simple"}, `"simple"`},
+		{[]string{`"quoted"`}, `"\"quoted\""`},
 		{[]string{}, `""`},
 		{[]string{``}, `""`},
 		{[]string{`foo`}, `"foo"`},
diff --git a/providers/cloudflare/auditrecords.go b/providers/cloudflare/auditrecords.go
index 66cf53d9d..44eafb41e 100644
--- a/providers/cloudflare/auditrecords.go
+++ b/providers/cloudflare/auditrecords.go
@@ -11,9 +11,7 @@ import (
 func AuditRecords(records []*models.RecordConfig) []error {
 	a := rejectif.Auditor{}
 
-	a.Add("TXT", rejectif.TxtHasTrailingSpace) // Last verified 2022-06-18
-
-	a.Add("TXT", rejectif.TxtIsEmpty) // Last verified 2022-06-18
+	a.Add("TXT", rejectif.TxtIsEmpty) // Last verified 2024-10-27
 
 	return a.Audit(records)
 }
diff --git a/providers/cloudflare/cloudflareProvider.go b/providers/cloudflare/cloudflareProvider.go
index 4865f828c..4c32b6c35 100644
--- a/providers/cloudflare/cloudflareProvider.go
+++ b/providers/cloudflare/cloudflareProvider.go
@@ -18,6 +18,7 @@ import (
 	"github.com/StackExchange/dnscontrol/v4/pkg/diff2"
 	"github.com/StackExchange/dnscontrol/v4/pkg/printer"
 	"github.com/StackExchange/dnscontrol/v4/pkg/transform"
+	"github.com/StackExchange/dnscontrol/v4/pkg/txtutil"
 	"github.com/StackExchange/dnscontrol/v4/pkg/zonecache"
 	"github.com/StackExchange/dnscontrol/v4/providers"
 	"github.com/StackExchange/dnscontrol/v4/providers/cloudflare/rtypes/cfsingleredirect"
@@ -871,7 +872,11 @@ func (c *cloudflareProvider) nativeToRecord(domain string, cr cloudflare.DNSReco
 			return nil, fmt.Errorf("unparsable SRV record received from cloudflare: %w", err)
 		}
 	case "TXT":
-		err := rc.SetTargetTXT(cr.Content)
+		s, err := txtutil.ParseQuoted(cr.Content)
+		if err != nil {
+			return rc, err
+		}
+		err = rc.SetTargetTXT(s)
 		return rc, err
 	default:
 		if err := rc.PopulateFromString(rType, cr.Content, domain); err != nil {
diff --git a/providers/cloudflare/rest.go b/providers/cloudflare/rest.go
index bc2f0b08c..ca0f7ee99 100644
--- a/providers/cloudflare/rest.go
+++ b/providers/cloudflare/rest.go
@@ -10,6 +10,7 @@ import (
 	"golang.org/x/net/idna"
 
 	"github.com/StackExchange/dnscontrol/v4/models"
+	"github.com/StackExchange/dnscontrol/v4/pkg/txtutil"
 	"github.com/StackExchange/dnscontrol/v4/providers/cloudflare/rtypes/cfsingleredirect"
 )
 
@@ -154,7 +155,7 @@ func (c *cloudflareProvider) createRecDiff2(rec *models.RecordConfig, domainID s
 		prio = fmt.Sprintf(" %d ", rec.MxPreference)
 	}
 	if rec.Type == "TXT" {
-		content = rec.GetTargetTXTJoined()
+		content = txtutil.EncodeQuoted(rec.GetTargetTXTJoined())
 	}
 	if rec.Type == "DS" {
 		content = fmt.Sprintf("%d %d %d %s", rec.DsKeyTag, rec.DsAlgorithm, rec.DsDigestType, rec.DsDigest)
@@ -229,7 +230,7 @@ func (c *cloudflareProvider) modifyRecord(domainID, recID string, proxied bool,
 		TTL:      int(rec.TTL),
 	}
 	if rec.Type == "TXT" {
-		r.Content = rec.GetTargetTXTJoined()
+		r.Content = txtutil.EncodeQuoted(rec.GetTargetTXTJoined())
 	}
 	if rec.Type == "SRV" {
 		r.Data = cfSrvData(rec)