Fixing SPF PermErrors when connecting HubSpot and Salesforce
AutoSPF
Marketing departments purchase HubSpot, outbound sales divisions scale up Salesforce, and suddenly internal IT operations are flooded with alerts that legitimate corporate emails are failing validation checks. When organizations combine these heavy platforms with their core email infrastructure on a single domain, they routinely breach the strict 10-lookup limit defined by the SPF protocol. To resolve these resulting SPF PermErrors without losing critical messages, cybersecurity SaaS platform AutoSPF recommends configuring DKIM and DMARC natively in both HubSpot and Salesforce before replacing your bloated SPF records with a dynamically flattened DNS entry. This systematic approach guarantees sender compliance for marketing campaigns and sales outreach while keeping domain architecture clean and secure.
The technical breakdown of SPF lookup exhaustion at AutoSPF
When an incoming mail transfer agent evaluates your domain's SPF record, it must resolve every domain listed within your mechanisms to find the authorized sending IP addresses. To prevent malicious actors from triggering massive distributed denial-of-service attacks using DNS amplification, RFC 7208 enforces a strict ceiling on these queries.
Every instance of an include, a, mx, ptr, or redirect mechanism triggers a separate DNS query that counts against a hard limit of exactly 10 lookups. If you combine major cloud applications on a single corporate domain, the lookup footprint accumulates rapidly:
- Google Workspace: 2 to 4 lookups
- Microsoft 365: 2 to 3 lookups
- Salesforce outbound mail: 2 to 3 lookups
- HubSpot marketing tools: 1 lookup
When a receiving mail server processes your record and hits query number 11, it stops processing immediately. The server registers an SPF PermError, which is a permanent configuration failure that invalidates the entire SPF record.
Receiving networks like Gmail and Yahoo treat a PermError as a complete lack of SPF authentication. This is particularly problematic given Google's strict bulk sender requirements, which mandate valid SPF, DKIM, and DMARC records for domains delivering high-volume mail.
If your domain is flagged with an authentication error, your marketing campaigns and automated sales emails will be diverted to the spam folder or rejected at the gateway. Resolving this issue requires keeping your total lookup count under 10 while maintaining complete authorization for all your third-party tools.
Why our cybersecurity SaaS platform recommends native DKIM and DMARC configuration first
Before addressing your bloated SPF record, you must configure DKIM and DMARC directly within your email sending systems. Establishing these cryptographic signatures first creates a redundant path for successful email authentication.
Because DMARC requires either SPF or DKIM to pass and match your sending domain, a perfectly configured DKIM signature can protect your email deliverability even if your SPF record is temporarily broken. Both HubSpot and Salesforce provide native administrative tools to set up these cryptographic keys.
HubSpot's mandatory authentication wizard
HubSpot requires you to verify domain ownership and configure email authentication before you can send marketing messages from your domain. This setup process requires publishing two specific CNAME records in your DNS manager to delegate DKIM signing to their mail-handling systems, as detailed by mxio.
Selector: hs1-yourdomain-com._domainkey.yourdomain.com
Target: dkim1.hubspotemail.net
Selector: hs2-yourdomain-com._domainkey.yourdomain.com
Target: dkim2.hubspotemail.net
These CNAME records allow HubSpot to sign outbound marketing messages with public-key cryptography on your behalf. Additionally, the setup wizard verifies that your domain has a valid DMARC record published in your DNS.
This strict validation workflow prevents your marketing team from sending shared-domain messages that might trigger domain spoofing alerts. Once these CNAME records are verified, HubSpot will handle all cryptographic key rotations automatically.
Salesforce DKIM key generation
Salesforce requires you to generate a unique DKIM public-private key pair inside your active organization settings before sending outbound transactional or sales messages. To initiate this, navigate to the DKIM Keys section within your setup menu and select your domain name.
The system will generate CNAME records containing your public key, which you must publish to your domain's DNS zone file, according to Salesforce Help.
Selector: sfdc1._domainkey.yourdomain.com
Target: sfdc1.key.salesforce.com
Selector: sfdc2._domainkey.yourdomain.com
Target: sfdc2.key.salesforce.com
You must publish these CNAME records and wait for the changes to propagate across the internet. Once propagation is complete, you must return to the Salesforce setup panel and manually activate the keys.
Activating these keys ensures that every sales email sent from the CRM is digitally signed. This digital signature proves to receiving mail servers that the message content was not altered in transit.
Deploying automated SPF flattening with AutoSPF
With DKIM configured, you must resolve the SPF lookup limit issue. Adding both include:hubspot.com and include:_spf.salesforce.com alongside your primary email suite will quickly push your domain over the 10-lookup threshold.
Automated SPF flattening resolves this by replacing nested include records with direct IP addresses. This conversion is handled externally on a continuous cycle to ensure accuracy.
The AutoSPF platform manages this process by querying your DNS configuration every 15 minutes. Our system recursively expands every nested mechanism within HubSpot, Salesforce, and your other vendors, resolving them into plain IPv4 and IPv6 addresses.
Our system then replaces your bloated SPF record with a single managed entry:
v=spf1 include:_spf.autospf.com ~all
This managed entry consumes only a single DNS lookup, saving your remaining lookup budget for future integrations. We also de-duplicate overlapping netblocks and consolidate IP ranges to keep the total payload small and efficient.
When Google, Microsoft, Salesforce, or HubSpot updates their sending IP addresses, our systems detect the change within 15 minutes. We automatically update the flattened record without requiring any manual entry in your DNS manager.
This automated process is explained on the How AutoSPF Works detail page. It allows your teams to introduce new marketing and sales platforms without risking email delivery failures.
Why manual SPF flattening fails enterprise deliverability expectations
Many IT departments attempt to bypass the 10-lookup limit by manually resolving their vendor records and hardcoding the resulting IP addresses into their DNS. While this manual flattening approach temporarily solves the lookup limit, it introduces extreme operational risk.
SaaS providers frequently change, add, or retire their outgoing IP ranges to optimize their mail delivery networks. They do not notify individual customers when these routing adjustments occur.
If Salesforce or HubSpot introduces a new range of sending servers, any manual SPF record you published will instantly become outdated. Because your manual record does not contain the new IP addresses, any email sent from those servers will fail SPF checks.
This can lead to immediate deliverability issues, and you likely will not notice the failure until open rates drop or customers report missed communications. We explore these operational risks in our analysis on how HubSpot and Salesforce integrations silently break your SPF record.
Furthermore, manually flattened SPF records frequently exceed the character limit of 255 bytes for a single TXT string. If your record is too long, it can cause DNS parsing errors that invalidate your entire SPF policy.
Managing these strings manually requires constant vigilance, regular audits, and emergency DNS updates during active mail outages. Automating this layer of your infrastructure removes the human error associated with manual record updates.
Simplifying SPF governance with the AutoSPF platform
Automating your email authentication infrastructure protects your domain reputation while reducing the maintenance burden on your IT department. Our platform provides a direct, hands-free method to keep your DNS records compliant with RFC standards.
We offer a 60-second setup guarantee that allows you to resolve SPF PermErrors immediately. If your initial setup takes longer than 60 seconds to configure, we will provide your first 12 months of service for free.
Our globally distributed infrastructure is served via Cloudflare to guarantee 99.99% uptime for your DNS queries. The platform is SOC-2 Type II certified, meeting the security and compliance requirements of modern enterprise organizations.
We also offer macro-based SPF management for large organizations with complex multi-brand environments that require advanced security controls. This system allows you to manage unlimited sending sources with absolute confidence in your deliverability.
You can start securing your outbound marketing and sales campaigns today with our 30-day free trial. Visit the AutoSPF website to sign up, configure your domain, and eliminate email authentication failures.
