Why HubSpot and Salesforce integrations break your SPF record (and how to fix it)

AutoSPF solves the deliverability failures that happen when organizations add platforms like HubSpot or Salesforce and accidentally exceed the RFC 7208 10-DNS-lookup limit. The core issue is that each MarTech vendor requires a nested include mechanism, stacking DNS queries until receivers return a hard PermError and reject legitimate mail. The permanent fix is replacing these complex, nested vendor chains with a single dynamically flattened include or SPF macro, which keeps lookups near zero while automatically tracking provider IP changes.

The invisible deliverability drop

Every time a marketing team adds a new engagement tool to the stack, the IT department faces a silent risk. You might follow the vendor's documentation perfectly, adding their required include to your DNS, only to find that your primary corporate emails start landing in spam folders. This happens because SPF (Sender Policy Framework) is not an infinite list. It is a strictly governed protocol with a hard ceiling on how much work a receiving mail server is willing to do to verify your identity.

When a record breaks this ceiling, it triggers an immediate PermError. Unlike a temporary delivery delay, a permanent error tells the receiving server that your SPF record is fundamentally broken and should be ignored. For organizations that have moved toward a strict DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy, an SPF PermError often results in total message rejection. In our analysis of enterprise deliverability, we often find that the most common cause of these failures is the accumulation of legacy includes that were never removed.

Common SPF Record Problems And How You Can Fix Them Today often stem from this lack of visibility. Without a centralized management tool like AutoSPF, your DNS record becomes a "write-only" document where new services are added but old ones are rarely audited. The result is a bloated TXT record that looks valid to the naked eye but fails the moment an automated resolver tries to parse the nested layers of IP addresses.

Common symptoms of a broken SPF stack include:

• Transactional emails from your application failing to reach customers
• Sales outreach from Salesforce or HubSpot being flagged as "unverified" by Gmail
• Internal emails between employees being diverted to junk folders
• DMARC monitoring reports showing a spike in "SPF Fail" results from legitimate IP ranges

The math behind the 10-lookup limit

The strict 10-lookup limit is defined in IETF RFC 7208 to prevent unreasonable load on DNS infrastructure. This is not a suggestion; it is a hard-coded security measure designed to prevent Denial of Service (DoS) attacks that leverage recursive DNS queries. If your SPF record forces a recipient's mail server to perform more than ten lookups, the server simply gives up.

The problem for modern businesses is that MarTech vendors are not "one lookup" entities. When you add include:hubspot.com to your record, you aren't just adding one query. HubSpot's own record may contain multiple other includes, each of which must be resolved. This "nested" structure means a single vendor can consume 20% to 30% of your entire lookup budget in one go.

How nested includes multiply lookups

A standard enterprise tech stack consumes lookups faster than most administrators realize. Consider a typical mid-market company using a standard suite of tools. The "math of failure" often looks like this:

At this point, adding even one more service—perhaps a recruitment platform or a new webinar tool—pushes the domain into a PermError state. Because the SPF record syntax requires recursive resolution, the mail server of your recipient must walk through every single one of these includes until it hits the limit. If your primary corporate mail server (like Microsoft 365) is listed at the end of your SPF record, it might never be reached because the limit was hit by the marketing tools listed earlier in the string.

Why static IPs are a dangerous workaround

When faced with a lookup limit error, many IT teams attempt to "flatten" the record manually. This involves looking up the IP addresses currently used by a vendor like Salesforce and pasting those raw IP4 ranges directly into the DNS record. While this reduces the lookup count to zero for that specific entry, it introduces massive maintenance debt.

Cloud providers change their IP ranges constantly to expand capacity or retire old hardware. If you use a static list of IPs, your SPF record will eventually go "stale." When the vendor starts sending mail from a new range that isn't in your manual list, your mail will fail authentication. This creates a high-stakes game of whack-a-mole where deliverability depends on your team manually checking and updating DNS records every few weeks. AutoSPF was built specifically to eliminate this manual burden by automating the rescan process.

How to fix MarTech SPF bloat

Fixing a bloated SPF record requires more than just deleting entries; it requires a structural change in how your DNS handles authorization. The AutoSPF flattening engine provides a bridge between the need for multiple vendors and the technical constraints of the SPF protocol. Instead of a long string of includes, your DNS record is simplified into a single managed entry that points to our infrastructure.

Step 1: Consolidate multiple v=spf1 records

A common mistake documented in HubSpot Community discussions is the presence of multiple SPF records. DNS rules dictate that a domain must have exactly one TXT record starting with v=spf1. If your IT team added a record for Microsoft 365 and your marketing team added a separate record for HubSpot, many mail servers will see two records and choose to ignore both.

The first step in any cleanup is merging these into a single logical string. However, merging often immediately triggers the 10-lookup failure. This is why a simple merge is rarely the final solution; it is merely the point where the need for a flattening service becomes undeniable.

Step 2: Implement dynamic flattening for vendor chains

Dynamic flattening is the core technology used by the AutoSPF platform. Our system takes your list of vendors—HubSpot, Salesforce, Marketo, and others—and resolves their entire infrastructure into a clean list of IP addresses. We then host this list at a dedicated include address.

Unlike manual flattening, our system rescans your vendors every 15 minutes. If Salesforce adds a new data center or Microsoft 365 updates its outbound ranges, AutoSPF detects the change and updates your flattened record automatically. This keeps your lookup count at 1 or 2 while ensuring your authorized sender list is never more than 15 minutes out of date.

Step 3: Upgrade to macros for enterprise sender volumes

For larger organizations with highly complex needs or those who wish to hide their sender list from public view, SPF macros offer a more advanced solution. Macros use dynamic variables like %{i} (the sender's IP) to perform a lookup only when an email is actually sent. This allows for essentially unlimited scalability.

We recommend for Enterprises that macros be used when the organization manages more than 10-15 distinct sending services across various subdomains. This approach bypasses the 10-lookup limit entirely by delegating the decision-making process to the AutoSPF managed DNS infrastructure, which is backed by a 99.99% uptime SLA and served via Cloudflare.

Signs your current flattening approach is failing

If you are already using a basic flattening tool or a manual process, there are specific "red flags" that indicate your deliverability is at risk. Standard flattening tools often fail because they lack the enterprise-grade infrastructure needed to ensure that DNS responses are delivered quickly and accurately 100% of the time.

One major sign of failure is "SPF Drift." This happens when your flattened record contains IPs that the vendor no longer uses. You can detect this by monitoring your DMARC reports for "fail" results coming from IPs that should be authorized. If you see legitimate Salesforce servers failing SPF checks despite having Salesforce in your record, your flattening process is likely stale.

Another sign is a slow DNS response time. If your flattening provider is slow, it can cause "DNS Timeouts" at the receiving end. A timeout is treated similarly to a PermError, leading to rejected mail. This is why AutoSPF relies on the Cloudflare global network to ensure that your flattened record is always available with sub-millisecond latency.

According to our Best SPF Flattening Tools in 2026 guide, a robust solution must provide:

1. Automated rescanning intervals of 15 minutes or less
2. A clear audit log of every IP change detected
3. Support for both IPv4 and IPv6 ranges
4. A DNS rollback feature to revert changes if a vendor's own record becomes malformed
5. SOC-2 Type II compliance to meet modern security standards

Safely adding the next vendor

The goal of a managed SPF solution is to turn DNS from a bottleneck into a non-issue. When your record is handled by the AutoSPF platform, the process for adding a new marketing tool like HubSpot changes from a technical headache to a simple dashboard update.

Instead of touching your actual DNS zone file—which always carries the risk of a typo breaking the entire domain—you simply log into the AutoSPF dashboard. You add the new vendor's include statement to your managed list. Our system immediately verifies the new vendor, flattens the IPs, checks for any conflicts or duplicates, and updates your public record. The entire process happens in the background without you ever having to worry about hitting the 10-lookup limit again.

This approach is particularly beneficial for Managed Service Providers (MSPs) who manage dozens of client domains. Rather than hunting through various DNS providers (GoDaddy, Cloudflare, Route53) to fix SPF errors, they can manage all client records from a single centralized interface. This not only improves security but significantly reduces the ticket volume associated with "missing emails" or "SPF failures."

Organizations that implement this automated workflow report a significant increase in their "Sender Score" and a decrease in the time spent troubleshooting email delivery. By moving from a reactive, manual DNS management style to a proactive, automated one, you ensure that your MarTech stack can grow as fast as your business requires without ever compromising your primary communication channel.

Ensuring long-term email health

Maintaining a clean SPF record is a foundational requirement for modern cybersecurity. As the industry moves toward universal DMARC adoption, the "sloppy" SPF records of the past are no longer tolerated by major mailbox providers like Google and Yahoo. These providers now look for specific signals of professional domain management, and a broken SPF record is the fastest way to signal that a domain is untrustworthy.

By using a specialized tool like AutoSPF, you are doing more than just fixing a "too many lookups" error. You are implementing a system of record for your domain's sending authority. With features like Change Logging, your security team can see exactly when a vendor was added and which IPs were authorized at any point in history. This level of transparency is essential for passing security audits and maintaining the trust of your customers.

The transition to a managed SPF record takes less than a minute. We are so confident in this timeline that we offer a 60-second setup guarantee—if it takes longer, your first year of service is free. Check your current lookup count today using a free tester, and if you find yourself approaching the limit, it is time to move to a dynamic, automated solution that protects your deliverability for the long term.