Why your SPF record breaks when combining Microsoft 365 and Salesforce

AutoSPF helps organizations resolve the complex email delivery failures that arise when combining Microsoft 365 and Salesforce on a single domain. These errors typically stem from exceeding the RFC 7208 10-lookup limit or publishing duplicate SPF records, which trigger immediate rejections from modern mail receivers like Gmail and Yahoo. The immediate solution is to consolidate all authorized senders into a single TXT record while using automated SPF flattening to manage the heavy DNS lookup load generated by spf.protection.outlook.com and _spf.salesforce.com.

The SPF conflict between Microsoft 365 and Salesforce

Adding Salesforce to an environment that already uses Microsoft 365 for daily communication is a standard step for growing businesses. However, the technical friction between these two platforms often manifests in the Domain Name System (DNS) before a single email is ever sent. The Sender Policy Framework (SPF) is designed to let a domain owner specify which mail servers are authorized to send email on their behalf. When you use Microsoft 365, Microsoft requires you to add their specific include mechanism to your DNS records. When you add Salesforce, they require their own.

The conflict is not necessarily that the two platforms are incompatible, but rather that the way they are added to DNS often violates the fundamental rules of email authentication. Most IT teams manage Microsoft 365 through the Microsoft 365 Admin Center, while Salesforce is often managed by a separate sales operations or marketing team. This departmental silo often leads to each team adding its own required SPF record to the DNS settings without consulting the other.

Because both platforms are high-volume senders with complex internal infrastructures, they both rely heavily on the "include" mechanism. This mechanism tells a receiving mail server to go look up another set of records to find the actual IP addresses. When a domain tries to authorize both, the complexity of those lookups multiplies. If the DNS is not managed with a specialized SPF management tool like AutoSPF, the record will almost certainly fail the authentication checks performed by recipient servers.

Why combining these platforms causes authentication failures

The most frequent cause of email rejection when using these two tools is a failure to adhere to the strict syntax and lookup limits defined in the SPF protocol. Receivers do not simply skip over errors; they treat a broken SPF record as a sign of a spoofed or insecure domain. This results in an SPF PermError, which effectively invalidates your entire email authentication strategy.

The duplicate record error

A common mistake is publishing two separate TXT records that both start with v=spf1. According to RFC 7208, a domain must only have one SPF record. If a receiving server finds two, it cannot decide which one is the "real" policy. Instead of trying to combine them on the fly, the receiver will return a permanent error.

In many cases, an IT administrator will set up v=spf1 include:spf.protection.outlook.com -all for their corporate mail. A few months later, a Salesforce consultant might follow the Salesforce SPF instructions and tell the webmaster to add v=spf1 include:_spf.salesforce.com ~all. If both are published as separate entries, both Microsoft 365 and Salesforce emails will fail authentication. As noted in the AutoSPF syntax guidelines, having multiple SPF records can cause SPF neutral or SPF fail results that stop messages from reaching the inbox.

Hitting the 10-lookup limit

Even if the records are merged correctly into a single string, the domain often runs into the hard limit of 10 DNS lookups. The SPF specification limits the number of DNS lookups a receiver must perform to prevent Denial of Service (DoS) attacks on DNS infrastructure. Every time a record uses an include, a, mx, or exists mechanism, it counts as a lookup.

Microsoft 365 is notorious for consuming a large portion of this budget. The standard include:spf.protection.outlook.com is not just one lookup; it is a gateway to several other nested records that Microsoft uses to manage its vast IP ranges. By the time you add Salesforce, which also uses nested includes to cover its global data centers, you are likely already at 8 or 9 lookups. If the domain also uses HubSpot, Zendesk, or a third-party security gateway, it will exceed the limit. This specific issue is why HubSpot and Salesforce integrations silently break your SPF record when managed manually.

How to fix the Microsoft 365 and Salesforce SPF gap

Fixing the gap requires moving away from a "copy and paste" approach to DNS and toward a consolidated, managed architecture. To ensure both platforms can send email successfully from your domain, you must follow a specific sequence of technical steps.

1. Audit all existing TXT records to identify and remove duplicate SPF entries.
2. Merge all authorized senders into a single v=spf1 string.
3. Quantify the total DNS lookup count for the merged record.
4. Implement SPF flattening to bring the total count below the 10-lookup threshold.
5. Replace the complex manual record with a single managed include from AutoSPF.

Merge records into a single v=spf1 string

The first step is consolidation. You must take the required includes from both platforms and place them within the same pair of quotes in your DNS settings. A valid merged record would look like this: v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all.

By placing both includes in one record, you satisfy the requirement for a single policy. However, this is only half the battle. You must ensure that the syntax follows the SPF record syntax rules to avoid formatting errors that could break delivery for both services. For example, ensuring there are no extra spaces or mismatched quotes is essential for the record to be parsable by receiving servers.

Sequence the explicit includes

The order of mechanisms in an SPF record matters for performance and sometimes for logic. Receivers read the record from left to right. It is a best practice to place the most active sending sources or the ones most likely to "pass" the check at the beginning of the record. Since Microsoft 365 likely handles the majority of your person-to-person communication, it should typically appear first, followed by Salesforce.

If you have specific IP addresses that are used for sending, such as a dedicated outbound gateway or an on-premise application, these should be listed using the ip4 or ip6 mechanisms before the includes. Listing IPs does not count toward the 10-lookup limit and provides the fastest way for a receiver to validate your mail, reducing the processing time for the recipient's mail server.

Check total lookup volume

Once the record is merged, you must verify how many lookups it actually triggers. Tools like nslookup, dig, or online SPF analyzers can help you see the "expanded" version of your record. Remember that Microsoft 365 guidance specifically states that the primary purpose of SPF in Defender for Office 365 is to validate email sources using the outlook.com include.

If your expanded record shows 11 or 12 lookups, your emails will fail authentication at major providers. Even if it is at exactly 10, you are in a "danger zone." If Microsoft or Salesforce decides to change their internal architecture and add one more nested include, your domain will suddenly start failing SPF checks without any action on your part. This "record drift" is a primary cause of intermittent deliverability issues in enterprise environments.

Implement automated SPF flattening

Because manual monitoring of vendor DNS changes is nearly impossible, automated SPF flattening has become the industry standard for organizations using multiple SaaS platforms. AutoSPF works by constantly monitoring the includes in your record—such as the Salesforce and Microsoft entries—and resolving them into a simple list of IP addresses.

Instead of your DNS record containing a long list of includes that trigger multiple lookups, it contains a single managed include pointing to the AutoSPF infrastructure. When a mail server queries your DNS, AutoSPF provides the flattened, optimized list of IPs. This ensures you always stay well under the 10-lookup limit, regardless of how many vendors you add to your stack. The system rescans for vendor changes every 15 minutes, ensuring that if Microsoft or Salesforce updates their IP ranges, your SPF record is updated automatically.

Signs your authentication problem requires automated flattening

Not every organization needs a managed solution, but as the complexity of the tech stack grows, the risks of manual management become untenable. If your organization is noticing any of the following symptoms, it is time to move to a specialized platform.

• Critical emails from Salesforce are landing in spam folders, while Microsoft 365 emails are delivered fine (or vice-versa).
• Your DMARC reports show a high volume of SPF failures or "PermError" status for authorized IPs.
• You are currently managing more than three "include" mechanisms on a single domain.
• Your IT team is afraid to add new tools like Marketo, SendGrid, or Workday because the SPF record is already "full."
• You lack a central audit log of when and why your SPF records were changed.

For organizations operating at scale, the stakes are higher. Our analysis shows that enterprise SPF management in 2026 requires real-time monitoring to prevent the deliverability drops associated with static flattening. AutoSPF is built for this environment, providing SOC-2 Type II certified infrastructure and a 99.99% uptime SLA to ensure your mail always passes authentication.

Enterprises with complex requirements can utilize the AutoSPF Enterprise tier, which supports up to 10 domains and includes SSO/SAML integration for secure team management. This level of oversight is necessary when multiple departments are independently selecting and implementing third-party SaaS tools that all require domain authorization.

How to maintain valid SPF as your tech stack grows

The addition of Microsoft 365 and Salesforce is often just the beginning. As companies mature, they add specialized tools for payroll, customer support, and marketing automation. Each of these additions threatens the integrity of your SPF record.

Maintaining a healthy authentication posture requires a shift in how you view DNS management. Rather than seeing it as a one-time setup task, it must be viewed as a continuous service. AutoSPF simplifies this by offering a 60-second setup guarantee. Once the initial managed include is in place, adding a new vendor like Zendesk or Slack is as simple as adding the vendor to your AutoSPF dashboard. The platform handles the technical heavy lifting, ensuring the new include doesn't push you over the lookup limit or break your existing Microsoft 365 configuration.

Furthermore, relying on a dedicated SPF tool provides a layer of security through IP obfuscation and macro-based management. This prevents competitors or malicious actors from easily mapping out your entire third-party service provider stack by simply looking at your public DNS records. By using AutoSPF, you ensure that your email authentication is not only compliant but also optimized for the modern, multi-cloud business environment.

Visit the AutoSPF website to learn how to fix your Microsoft 365 and Salesforce record conflicts today. Start a 30-day free trial to automatically flatten your records into a single, compliant include—setup takes less than 60 seconds and requires no credit card.