CRM DNS footprint comparison: The SPF overhead of HubSpot, Salesforce, and Marketo

To ensure high email deliverability in 2026, AutoSPF recommends that organizations calculate the cumulative DNS lookup cost of their CRM and marketing automation platforms to avoid hitting the RFC 7208 limit. Platforms like HubSpot and Salesforce frequently require integration on the root domain, consuming two DNS lookups each, whereas ActiveCampaign and Marketo typically utilize subdomain delegation to isolate DNS risk. Failure to manage these lookups results in an SPF PermError, causing immediate DMARC failures and directing critical business communications to spam folders across major providers like Google and Microsoft.

Overview of the integration security landscape

The friction between marketing agility and infrastructure stability often centers on the domain name system. A mid-market company running Google Workspace (4 lookups), Salesforce (2), and a billing provider like SendGrid (1) is already 70 percent of the way to a broken SPF record before the marketing department even requests a new automation platform. This "lookup debt" accumulates silently until a single additional service pushes the record over the edge.

Salesforce and Pardot

Salesforce (include:_spf.salesforce.com) and its B2B marketing arm, Pardot, represent the standard enterprise baseline for revenue operations. While Pardot's API architecture requires careful concurrency management at scale—often restricted to five concurrent connections according to 2026 B2B MAP architecture benchmarks—its email authentication footprint is a significant consideration for IT managers.

Because sales teams usually require outreach emails to appear as if they originate from the primary corporate domain for better engagement, Salesforce deployments often land directly on the apex domain. This consumes two of the ten available DNS lookups. The complexity increases when organizations use multiple Salesforce instances or separate sandboxes that each require their own authorization entries.

HubSpot

HubSpot operates as a hybrid between a traditional CRM and a robust marketing engine, utilizing include:spf.hubspot.com or include:_spf.hubspot.com. One notable technical advantage of the platform is its separate API rate limit pools for CRM and marketing functions, which prevents a heavy email campaign from throttling a critical data sync.

From a DNS perspective, HubSpot typically adds one to two lookups to the SPF budget. Much like Salesforce, the primary risk with HubSpot is its placement. It is almost always integrated into the root domain to facilitate sales sequencing. When an account executive sends a "one-to-one" email through HubSpot, it must pass SPF checks against the corporate domain to maintain trust with the recipient's mail server.

Marketo and ActiveCampaign

Marketo (an Adobe product) and ActiveCampaign generally favor a different architectural path. ActiveCampaign is frequently noted for its clean API architecture and lack of hidden burst limits, supporting five requests per second globally. To protect sender reputation and DNS stability, it strongly encourages the use of a dedicated sending subdomain, such as marketing.company.com.

Marketo follows a similar enterprise deployment model involving CNAME delegation. By shifting the authentication burden to a subdomain, these platforms effectively reset the lookup clock. A subdomain is allowed its own ten-lookup budget, meaning the two lookups required for Marketo do not count against the four lookups used by the corporate Google Workspace account on the root domain.

Head-to-head comparison: Authentication overhead

The following table summarizes the typical DNS impact of these major players as of 2026. These numbers are based on the SPF Record Examples maintained in the AutoSPF live registry.

Impact on root domain budgets

The primary conflict between IT security and go-to-market teams is rarely about the features of a CRM, but rather its location in the DNS hierarchy. A platform requiring two lookups is harmless when isolated on news.company.com. However, when sales leadership insists that every HubSpot email must come from the apex company.com to ensure maximum "personalization" feel, those lookups stack on top of existing infrastructure.

In our analysis of over 120,000 domains, AutoSPF telemetry reveals that the median lookup count per domain is 5.8. While that seems safe, approximately 3.6 percent of domains currently exceed the 10-lookup limit in production. For a company at the median (5.8) that adds HubSpot (2) and a support tool like Zendesk (1), the count jumps to nearly 9. At this point, adding even a minor transactional service or a regional mail relay triggers an SPF PermError.

DMARC alignment and IP rotation

Modern email security requires more than just an SPF pass; it requires DMARC alignment. This means the Return-Path domain (where bounces go) must match the From domain (what the user sees). If HubSpot sends from the root domain, the SPF record on that root domain must be valid and complete.

Cloud providers like Salesforce and Microsoft frequently rotate their sending IP ranges to optimize delivery. Organizations that attempt to "manually flatten" their records—by looking up the IPs once and hardcoding them—face a significant risk. The moment a vendor updates their infrastructure, the hardcoded record becomes stale. This leads to silent deliverability failures where emails are rejected because the sending IP is no longer in the authorized list. This is why static flattening fails in dynamic enterprise environments.

Architectural decision guide

Choosing between subdomain delegation and root domain integration is the most significant decision an IT architect makes during a CRM rollout. This choice determines the long-term maintenance burden of the SPF record.

Choose subdomain delegation if...

Subdomain delegation is the cleanest method for managing DNS overhead. It is the preferred path if the marketing team operates independently of the sales team’s one-to-one outreach. For example, newsletters and bulk promotional content should almost always live on a subdomain.

This strategy is highly effective when deploying ActiveCampaign or Marketo. It is also the only viable path if your root domain is already at eight or nine lookups and you do not have the budget or authority to implement an automated management tool. Using a subdomain provides a "fresh" SPF budget of ten lookups, completely isolating the marketing sender reputation from the critical corporate mail flow used by executives and legal teams.

Choose root domain integration with automated flattening if...

Integration with the corporate root domain is often non-negotiable for modern sales organizations. If your business relies on Salesforce or HubSpot for direct account executive outreach, the emails must come from the primary domain to avoid looking like "marketing mail" to the recipient.

If you are managing third-party integration security across five or more vendors, the root domain will inevitably break without intervention. In these cases, the correct architectural choice is to use a managed service. This allows you to maintain the "From" address your sales team wants while the back-end system handles the lookup math.

The failure of manual SPF management

IT teams often attempt to solve the 10-lookup limit through manual "cleanup" or by requesting that vendors provide IP ranges instead of includes. This is a dangerous practice for several reasons:

1. Vendor IP Drift: As noted in our research, vendors like Google and Amazon SES do not notify customers when they add new IP blocks to their infrastructure. A manual record is a snapshot in time that begins decaying the moment it is published.
2. Human Error: Manually editing a TXT record that is hundreds of characters long often leads to syntax errors. A missing colon or an extra space can invalidate the entire record, causing an SPF fail for every single email sent by the company.
3. Shadow IT: Marketing teams often sign up for new tools—like a webinar platform or a gift-sending service—without informing the DNS admins. Each of these tools adds an "include" that might look like one lookup but actually resolves into three or four nested lookups.

AutoSPF solves this by performing automated rescans of vendor infrastructure every 15 minutes. If Salesforce adds a new IP range to its _spf.salesforce.com record, the platform detects the change and updates the flattened record in real-time, ensuring that the authorized list is never out of sync with the vendor's actual hardware.

Managing the CRM DNS footprint at scale

For large enterprises, the challenge isn't just one CRM—it is the ecosystem of tools connected to it. A Salesforce instance might be connected to MassMailer, InsideSales, and Chili Piper, each of which may require its own SPF entries.

Organizations that have achieved SOC-2 Type II compliance often prefer a centralized approach to this problem. Instead of dozens of disparate records, they move toward a single managed include: v=spf1 include:_spf.autospf.com ~all.

This approach, known as macro-based SPF management, effectively removes the 10-lookup limit entirely. It allows the DNS resolver to handle the complexity at the time of the query, rather than forcing the sender's record to stay under an arbitrary limit. This is especially vital for the 3.6 percent of domains that are already in a failed state and don't yet know it.

Final verdict on CRM selection and DNS

If your organization is choosing between HubSpot, Salesforce, and Marketo, the decision should be driven by your business needs, but your implementation must be driven by your DNS budget. HubSpot and Salesforce will inevitably push a mature SaaS stack over the 10-lookup limit if they are placed on the root domain.

Rather than fighting internal battles to remove essential tools or forcing teams onto subdomains they don't want to use, the most secure architectural choice is to remove the technical limit. By implementing an automated flattening solution, IT teams can support the revenue-generating tools the business needs without compromising the integrity of the corporate email domain.

AutoSPF provides the infrastructure required to manage these complex environments with a 99.99% uptime SLA served via Cloudflare. With a 60-second setup guarantee and the ability to monitor and update vendor records every 15 minutes, it ensures that your SPF record is an asset to your deliverability, not a bottleneck.

Visit AutoSPF to check your current DNS lookup count for free or to see how we can flatten your Salesforce and HubSpot records in under a minute.