How HubSpot and Salesforce integrations silently break your SPF record

AutoSPF identifies and resolves the "too many DNS lookups" problem that occurs when organizations integrate modern marketing and sales platforms. When a business adds a new HubSpot or Salesforce include to its DNS, it often unknowingly breaches the RFC 7208 limit of 10 lookups, resulting in an immediate SPF PermError. This error causes receiving mail servers to reject all inbound mail from the domain, a catastrophic failure that AutoSPF prevents by automatically flattening complex records into a single, optimized entry every 15 minutes.

The math behind the RFC 7208 lookup limit

The Sender Policy Framework (SPF) was established to give domain owners a way to specify which mail servers are authorized to send email on their behalf. However, the protocol carries a strict technical constraint: a single SPF check cannot involve more than 10 DNS lookups. This limit was defined in RFC 7208 in 2014 to prevent denial-of-service (DoS) attacks. Without this cap, a malicious actor could craft a record that forces a receiving server to perform an infinite loop of DNS queries, effectively weaponizing the email verification process.

In the context of modern infrastructure, this 10-lookup budget is remarkably small. Mechanisms that trigger a lookup include a, mx, ptr, exists, include, and the redirect modifier. While ip4 and ip6 mechanisms are "free" because they contain the literal address, any mechanism that requires the server to ask a DNS resolver for more information counts toward the limit.

Most IT administrators at businesses using AutoSPF discover that their baseline infrastructure already consumes a significant portion of this budget. A standard Google Workspace implementation typically requires three to four lookups immediately. Microsoft 365 consumes a similar amount. By the time a domain has authorized its primary email suite and perhaps a transactional service like SendGrid, the lookup count often sits at seven or eight. This leaves almost no margin for the heavy nesting used by marketing automation tools.

How SaaS includes create a cascading lookup failure

The true danger of the lookup limit is not the primary include you add to your record, but the recursive chain of lookups that exist inside that vendor's record. When you add include:spf.hubspot.com to your DNS, you aren't just adding one lookup. You are telling every mail server in the world to go look at HubSpot's record, which in turn might point to several other records, each requiring its own DNS query.

Research from the HubSpot Community indicates that a single HubSpot include can trigger up to 9 recursive lookups depending on how their internal netblocks are structured at that moment. This happens because large SaaS providers manage massive, global IP ranges that are constantly shifting. To manage their own scale, they use nested includes to organize their traffic.

For an enterprise using a combination of these tools, the math becomes impossible. If your organization uses Microsoft 365 for corporate mail (3 lookups) and Salesforce for CRM-driven outreach (2 lookups), adding HubSpot for marketing automation (9 lookups) pushes the total to 14. This is a clear breach of the protocol. At this point, the domain enters a state of PermError, and the AutoSPF platform is often the only way to restore functionality without stripping away essential software.

The blast radius of an SPF PermError

When a domain exceeds the 10-lookup limit, it doesn't just "kind of" fail; it triggers a permanent error, or PermError. This is the most dangerous state for a domain's email health. Unlike a "SoftFail," which might simply land an email in the spam folder, a PermError tells the receiving server that the SPF record is fundamentally broken and cannot be interpreted.

Many modern mail filters are configured to treat an SPF PermError as a high-probability signal of spoofing. Consequently, the receiving server may reject the message entirely before it even reaches the recipient's spam filter. This failure is often silent. The marketing team might notice a sudden drop in open rates for their HubSpot campaigns, but the IT department remains unaware that the CEO's personal emails and the company's automated password reset messages are also being blocked.

The blast radius of this failure covers the entire domain. Because SPF is checked at the domain level, a single integration added by the marketing department can break email delivery for every other department. This includes human-to-human communication, transactional alerts, and critical B2B exchanges. Without a tool like AutoSPF to monitor these limits, companies often spend days or weeks diagnosing "mysterious" delivery issues that are actually rooted in a simple DNS overflow.

Why manual IP flattening creates worse security gaps

When IT teams first diagnose a lookup limit issue, the common "quick fix" is to manually flatten the record. This involves looking up the IP addresses currently used by HubSpot or Salesforce and listing them directly in the SPF record as ip4 or ip6 mechanisms. While this technically reduces the lookup count to zero for those specific entries, it creates a maintenance nightmare and a significant security risk.

The problem is that SaaS providers do not use static IP ranges. Infrastructure is added, removed, and rotated constantly to handle load and maintain security. Adam Lundrigan, CTO of DuoCircle and architect of the AutoSPF engine, notes: "Vendor IP ranges change constantly—Google rotated their _netblocks three times in 2025 alone. A flattened record that isn’t automatically re-resolved goes stale and silently de-authorizes legitimate senders."

If you manually flatten your Salesforce record today, you might be authorizing 50 specific IP ranges. If Salesforce adds a 51st range next Tuesday to handle a new data center, any email sent from that new range will fail SPF. You have effectively traded a PermError for an authentication failure. This is why manual vs. automated SPF flattening is no longer a matter of preference but a requirement for operational security.

Furthermore, manual flattening often leads to "record bloat." DNS TXT records have a character limit of 255 per string. A manually flattened record containing hundreds of IP addresses will quickly exceed this, causing the record to break entirely. Managing the split-string syntax required to handle long records is prone to human error, which further compounds the risk to the domain's reputation.

Automating third-party include resolution

The only sustainable way to manage complex SaaS integrations like HubSpot is through automated, dynamic flattening. AutoSPF approaches this by acting as a managed proxy for your SPF data. Instead of listing five or six complex includes in your DNS, you replace them with a single include pointing to the AutoSPF infrastructure: v=spf1 include:_spf.autospf.com ~all.

Behind the scenes, the AutoSPF engine performs the heavy lifting. It queries your vendors—HubSpot, Salesforce, Zendesk, and others—every 15 minutes. It resolves those nested includes, identifies the actual IP addresses in use, de-duplicates them to save space, and compresses the results into a flat list. When a mail server checks your SPF record, it only performs one or two lookups to reach the AutoSPF record, where it finds a perfectly formatted, up-to-date list of authorized IPs.

This method provides several technical advantages over manual management:

• Real-time monitoring: Infrastructure changes by your vendors are caught and reflected in your DNS within 15 minutes.
• Error prevention: The system automatically checks for syntax errors or "void lookups" before publishing, ensuring you never publish a broken record.
• Change logging: Every update is logged, providing an audit trail that is essential for SOC-2 Type II compliance and internal troubleshooting.
• Uptime guarantee: Since your email delivery depends on these lookups, AutoSPF serves its DNS via Cloudflare with a 99.99% uptime SLA.

As Brad Slavin, General Manager of DuoCircle, explains: "The 10-lookup limit is the single most common reason enterprise SPF records silently break. A team adds a new SaaS tool, its include pushes the total past 10, and legitimate email starts failing." By moving to a managed model, organizations can stop treating DNS as a static file and start treating it as a dynamic part of their security stack. This shift is essential for protecting your domain's critical email sender reputation in an era where SaaS complexity only continues to grow.

If your current SPF record is approaching the limit, you can evaluate your lookup count using the free tools provided by AutoSPF. For organizations managing multiple domains or complex enterprise stacks, transitioning to automated SPF flattening is the most effective way to ensure that marketing growth doesn't come at the expense of domain-wide deliverability.

Check your current lookup count today. If you are at 8 or more lookups, you are one integration away from a domain-wide outage. You can start a 30-day trial of AutoSPF on any of our pricing plans to secure your record before the next vendor integration breaks your email routing.