They are not technically required but it helps for user clarity, I am guessing Cloudflare recently started requiring the quotes just for UI purposes? Maybe they are being stripped out when the DNS record is actually queried?
https://www.mailhardener.com/blog/5-common-mistakes-with-spf
Mistake 2: Quoted TXT record
The content of a DNS TXT type record is often displayed with double quotes, but those quotes are not (or should not be) part of the actual DNS record content.
The quotes are there for display purposes only. Since a TXT type DNS record is allowed to contain leading/trailing whitespace characters, the quotes help to distinguish the start and end of the record content.
Hence, it is common for email services to show setup instruction with quotes in the examples, but you should not include those quotes in the actual DNS record.
The SPF standard states that the SPF record must begin with v=spf1, so if your record starts with “v=spf1 (note the quote) it will not be recognized.
To make matters worse, some DNS service providers require you to add the quotes when pasting, and some don’t. This leads to confusion.
