This suggestion is not workable where you block outbound SMTP from the website container, as realistically, everyone should do.
I've raised a ticket on this but it appears this change without any prior notice or consultation has actually broken email.
If you use Cloudflare and your mail is on a different server to your the website, customers will find their mail fails all SPF checks.
The a classification does not match because it now points to Cloudflare and the mx record does not match because it is a different IP. So the SPF record has no reference to the webserver sending email.
Enhance need to make sure that if you're going to set things one way of work, you don't then change this overnight, without any warning or consultation and by doing so, actually break websites in the process that were working perfectly before.