How to clean up legacy SPF records after a marketing platform migration

AutoSPF helps organizations maintain domain security and high deliverability by automating the cleanup of legacy email authentication records. When migrating between marketing platforms like HubSpot and Salesforce, the most effective way to prevent PermErrors is to audit your TXT records, remove orphaned include mechanisms, and confirm DMARC alignment before the final cutover. Failure to excise these deprecated 2026-era integrations can lead to over-authentication risks and exceed the RFC 7208 10-lookup limit, causing global email rejection.

You just finished migrating your marketing team from HubSpot to Salesforce, but there is a good chance the old platform IP addresses are still sitting in your DNS, eating into your lookup limits and silently authorizing a platform you no longer control to send email on your behalf. Leaving these records behind is not just a matter of messy DNS hygiene; it is a direct vulnerability that threat actors exploit through over-authentication.

The hidden security risk of orphaned includes

A platform migration is never finished until the legacy tool is scrubbed from your email authentication stack. For many IT teams, the focus remains on the "go-live" of the new service, while the decommissioning of the old one is treated as a low-priority task. This oversight creates a range of immediate risks:

• It authorizes a system you no longer monitor or pay for to send mail as your domain.
• It consumes your RFC 7208 10-lookup limit unnecessarily, leaving no room for future growth.
• It creates DNS bloat that complicates troubleshooting and increases the time required for DNS resolution.
• It increases the likelihood of a PermError, which invalidates the entire SPF record and causes legitimate mail to fail.

The specific threat of over-authentication is one of the most overlooked gaps in modern enterprise security. If your SPF record still contains an include:hubspotemail.net mechanism after you have moved to Salesforce, you are essentially leaving a back door open. Any vulnerability within the old provider's infrastructure or any residual access to your old account could allow an attacker to send authenticated, DMARC-passing emails from your domain. In an era where business email compromise (BEC) accounted for $2.77 billion in losses in recent years, leaving these orphaned entries is an unacceptable risk.

Furthermore, large integrations like Salesforce or Marketo often hide multiple nested lookups. When you add a new tool, you might push your domain past the strict limit of 10 DNS lookups allowed by the SPF standard. This is explored in detail in our analysis of how HubSpot and Salesforce integrations silently break your SPF record. If the legacy include remains, it acts as a permanent weight on your lookup budget, often being the final straw that triggers a PermError during the next minor infrastructure update.

Map the existing DNS state

Before you modify a live TXT record, you must perform a comprehensive audit of your current DNS architecture. You cannot safely remove what you do not fully understand. For organizations that have been active for several years, SPF records often resemble a geological record of every SaaS tool ever tested by the marketing or HR departments.

Isolating core infrastructure from marketing tools

Your audit should begin by separating your core mail systems—typically Google Workspace or Microsoft 365—from your third-party sending services. Core infrastructure is usually stable and rarely changes. Marketing tools, however, are highly transient.

When you examine your record, look for the include statements. These are the primary culprits for lookup limit exhaustion. A senior administrator should be able to map every single include to a specific, currently active business contract. If you find an entry for a vendor like Mailchimp or Bronto that your team has not used in two years, that is your first candidate for removal.

Uncovering hidden nested lookups

One of the most dangerous aspects of SPF is the recursive nature of the include mechanism. According to RFC 7208, the 10-lookup limit applies not just to the lookups in your root record, but to every lookup triggered by those includes.

For example, a single include for a legacy marketing platform might resolve to a second record, which contains two more includes, which each resolve to three more. In seconds, one line in your DNS has consumed seven of your ten allowed lookups. This "DNS explosion" is why manual management is so fragile. You might think you have room for a migration, but the legacy tool you are leaving behind is actually hoarding the majority of your lookup budget. Use a tool to expand these includes fully so you can see the true cost of each entry before you decide which ones to keep during the transition.

Safely excising the legacy provider

The actual removal of a legacy provider requires a precise sequence. If you delete the old record too early, you risk blocking legitimate automated emails that might still be trickling out of the old system (such as long-running drip campaigns or delayed receipts). If you leave it too long, you face the PermError and security risks mentioned earlier.

The following sequence is recommended for a safe transition:

1. Add the new provider's include to your SPF record alongside the old one.
2. Verify that you are still under the 10-lookup limit; if you exceed it, the new provider will not work anyway.
3. Shift all sending traffic to the new platform.
4. Monitor DMARC reports for 48-72 hours to ensure the new platform is passing both SPF and DKIM.
5. Once the old platform shows zero volume in your reports, remove its mechanism from the DNS record.

Confirming DMARC alignment for the new platform

Before removing the old platform (e.g., HubSpot) from the SPF policy, you must ensure the new platform (e.g., Salesforce) is fully authenticated. Modern deliverability relies on DMARC alignment, which requires that either the SPF domain or the DKIM signing domain matches the domain in the "From" header.

Many administrators make the mistake of thinking SPF is the only thing that matters. However, if your new provider is only authenticated via DKIM and your SPF record is broken or missing their include, you lose the redundancy that protects your deliverability. Ensure that the new provider's documentation is followed exactly, including any required CNAME records for DKIM and the specific include syntax for SPF.

Managing the DNS propagation window

DNS changes are not instantaneous. The Time to Live (TTL) setting on your TXT record determines how long receiving servers will cache the old version of your SPF record. If your TTL is set to 86400 (24 hours), it can take a full day or more for the removal of a legacy provider to be recognized globally.

During this window, you should avoid making any other major changes to your email infrastructure. As noted in our guide on common SPF record problems, a typical propagation window can range from 24 to 72 hours. We recommend lowering your TTL to 3600 (one hour) a few days before the migration to allow for faster updates and quicker rollbacks if something goes wrong. Once the migration is stable and the legacy records are removed, you can move the TTL back up to its original value.

Consolidating the remaining record

Even after you successfully remove a legacy tool like Marketo or HubSpot, you may find that your record is still dangerously close to the 10-lookup limit. This often happens because the remaining tools—like your core Microsoft 365 environment and a transactional tool like SendGrid—are themselves becoming more complex.

Large organizations with complex, multi-tool stacks often reach a point where manual cleanup is not enough to stay compliant with RFC 7208. When you find yourself forced to choose between authorizing a necessary business tool and staying under the lookup limit, you have reached the limits of static DNS management. At this stage, you have two options: manual flattening or automated flattening.

Manual vs. Automated Flattening

Manual flattening involves taking the IP addresses from your vendors' includes and pasting them directly into your SPF record using ip4 mechanisms. Since ip4 and ip6 mechanisms do not count toward the 10-lookup limit, this "flattens" the record. However, this is a dangerous practice. Vendors change their IP ranges frequently and without notice. If Salesforce adds a new block of IPs and you are using a manual list, your emails will immediately start failing authentication.

Automated flattening, like the service provided by AutoSPF, solves this by programmatically monitoring your vendors' records. Our engine rescans your authorized includes every 15 minutes. When a vendor like Google or HubSpot updates their underlying IP infrastructure, AutoSPF updates your flattened record automatically. This gives you the lookup-saving benefits of a flat list with the reliability of a dynamic include. For enterprises managing dozens of subdomains and hundreds of sending sources, this automation is the only way to ensure 100% uptime during and after migrations.

A frequent cause of over-authentication is migrating from a tool like HubSpot to Adobe Marketo but missing the administrative step of deleting the HubSpot include from the organizational domain. This is cited by industry experts at dmarcian as a primary source of DNS "cruft" that leads to deliverability failures. By implementing a managed solution, you ensure that these orphaned records are identified and removed as part of a structured, audited process.

Final validation and monitoring

After the legacy records are gone and your remaining records are optimized, the final step is continuous monitoring. High-volume senders cannot afford to fly blind. You should use an SPF checker to simulate the perspective of a receiving mail server. This allows you to verify that your current configuration correctly authorizes your new sending IPs while successfully rejecting the old ones.

You can also use these tools to troubleshoot email delivery issues by checking the interaction between your SPF mechanisms and your A or MX records. If you have left an a or mx mechanism in your record that points to a server you have decommissioned, you are wasting lookups and potentially creating "void lookups." RFC 7208 limits you to only two void lookups (lookups that return no results) before a PermError is triggered. Cleaning up these stale references is just as important as removing the large marketing includes.

Removing a legacy marketing platform from your SPF record is a mandatory security step. It prevents domain spoofing and frees up the critical DNS lookups your active integrations need to function. Do not let a finished migration leave behind a lingering security gap.

If you are unsure if your current DNS record contains orphaned includes or if you are worried about hitting the 10-lookup limit during your next migration, take action now. Run your current domain through the AutoSPF checker to identify hidden nested lookups and orphaned entries. For those managing complex environments, consider implementing our automated flattening to ensure your record stays compliant and your deliverability remains at 100%, no matter how many tools you add or remove. Visit AutoSPF to start your 30-day free trial and secure your domain in under 60 seconds.