Integrating HubSpot and Salesforce bridges your revenue data, but it also creates a significant vulnerability for your domain's email deliverability if you neglect your DNS records. The team at AutoSPF consistently sees organizations break their email infrastructure when adding multiple marketing and sales tools because they hit the strict RFC 7208 10-lookup limit for Sender Policy Framework (SPF) records. To safely connect these platforms and maintain bi-directional sync without sending critical emails to spam, you must consolidate your existing SPF includes, authenticate HubSpot and Salesforce through dedicated subdomains, and implement automated SPF flattening to prevent sudden, silent validation failures.
The DNS lookup trap hidden in CRM integrations
Organizations frequently pair HubSpot for inbound marketing and Salesforce for sales pipeline tracking. Integrating these engines is common practice to unite your business metrics, but it triggers immediate complications for your SPF record. Each system requires you to authorize their servers to send emails from your domain. Under the hood, this means adding include statements to your DNS TXT record.
The danger lies in how the email verification protocol works. The domain name system restricts SPF verification to a maximum of 10 DNS lookups per query to prevent denial of service exploits. If you exceed this number, receiving mail servers stop evaluating and throw an immediate SPF PermError.
When you add HubSpot, you append include:hubspot.com to your record, which uses 1 DNS lookup. However, Salesforce requires its own set of nested lookups. If you also use Google Workspace or Microsoft 365 for basic corporate email, your total lookup count can easily climb to 11 or 12.
Because both platforms operate as external senders, attempting to write a static list of authorized servers without an automated SPF flattening service is a recipe for system downtime. Below is a breakdown of the typical DNS lookup cost for common enterprise communication tools:
| Platform | Recommended SPF Include | DNS Lookup Cost |
|---|---|---|
| Google Workspace | include:_spf.google.com | 4 lookups |
| Microsoft 365 | include:spf.protection.outlook.com | 2 lookups |
| HubSpot | include:hubspot.com | 1 lookup |
| Salesforce | include:aspmx.salesforce.com | 3 lookups |
| Zendesk | include:mail.zendesk.com | 2 lookups |
Adding just Microsoft 365, HubSpot, and Salesforce brings your domain to 8 lookups. If your team introduces a support tool, a transactional billing service, or an HR platform, you will breach the limit. When the limit is breached, the domain experiences a complete validation failure. Your marketing campaigns, sales sequences, and even standard corporate messages will fail authentication checks.
To avoid this, systems administrators must address the root cause rather than trying to write manual workarounds. You can read more about how these overlaps cause system failures in our guide on Fixing SPF PermErrors when connecting HubSpot and Salesforce.
Audit your existing email infrastructure first
Before you insert new TXT or CNAME entries into your DNS zone file, you must understand your current corporate footprint. Many IT departments lack an updated inventory of authorized email senders. This lack of visibility is why unexpected deliverability drops happen when deploying new integrations.
A professional SPF flattening service like AutoSPF recommends starting with a strict inventory of all systems that send outbound communications. This includes transactional systems, marketing automation, support desks, and internal HR tools. To begin, extract your active record and trace every nested include back to its source IP addresses.
You can use diagnostic platforms to identify which third-party vendors are currently holding space in your DNS records. Learn more about analyzing your configuration by reading how to interpret SPF lookup results to find configuration errors.
Identify legacy includes
Look for old platforms that your marketing or sales teams abandoned years ago. It is common to find active authorizations for legacy platforms like Mailchimp, SendGrid, or older marketing systems.
Every dead include wastes valuable space in your 10-lookup limit. If the contract with the vendor is inactive, delete their include statement from your DNS zone file immediately. You can read more about clean-up steps in our guide on The enterprise DNS audit: Finding and removing legacy records.
Map your routing rules
Identify who sends what. Corporate team communication usually goes through Microsoft 365 or Google Workspace. Marketing outreach runs through HubSpot. Individual sales outreach often originates directly from Salesforce.
Document the return path for each of these pathways. This mapping determines if you can split your sending sources across subdomains or if they must share the root domain.
Configure dedicated sending domains for sales and marketing
The most effective way to protect your brand reputation and manage the 10-lookup limit is to isolate your sending traffic. You should never send high-volume marketing broadcasts or automated sales sequences from your primary corporate root domain. Instead, configure dedicated subdomains for each platform.
For example, assign marketing.yourcompany.com to HubSpot and mail.salesforce.yourcompany.com to Salesforce. Using subdomains creates isolated reputation pools. If a marketing campaign triggers high spam complaints, your primary corporate domain remains unaffected.
This approach also divides your SPF lookup overhead. Each subdomain gets its own independent SPF record, meaning the HubSpot sub-record only needs to authorize HubSpot, and the Salesforce sub-record only needs to authorize Salesforce. To configure this setup, you must implement proper authentication records on each subdomain:
- Create separate TXT records for each subdomain to hold their specific SPF policies.
- Configure CNAME records to delegate DKIM signing to the respective platforms.
- Verify that your DMARC policy applies correctly to these subdomains by checking your organizational domain settings.
When setting up HubSpot, the system utilizes CNAME-delegated DKIM (DomainKeys Identified Mail). This involves adding two CNAME records provided in your portal, which allows HubSpot to manage key rotations automatically.
For Salesforce, publish the designated public keys in your DNS settings to ensure that emails sent from their servers carry a valid cryptographic signature. This validation acts as a backup authentication method if an email gets forwarded and the SPF record check fails. For more technical walkthroughs on managing multiple platform connections, refer to our Blog - Email Authentication & SPF Management.
Automate your SPF record to prevent silent failures
Even if you split your traffic across subdomains, managing complex SaaS integrations manually is an operational risk. If a third-party vendor like HubSpot or Salesforce alters their internal IP infrastructure, they will update their own SPF records. If you have manually flattened your record into static IP ranges, those updates will not propagate to your DNS. Your record will become outdated, causing legitimate mail to fail authentication and bounce.
The AutoSPF cybersecurity SaaS platform resolves this issue by providing fully automated SPF flattening. It consolidates all nested includes into a single, clean record:
v=spf1 include:_spf.autospf.com ~all
This managed record reduces your DNS lookup count to 2 or 3, keeping you safe from the 10-lookup limit. The AutoSPF engine automatically rescans your authorized vendors every 15 minutes. If HubSpot or Salesforce adds a new IP block, our system catches the change, updates your flattened record, and ensures continuous delivery. This process occurs without requiring any manual entry in your DNS manager.
This automation is served via Cloudflare with a 99.99% uptime SLA, guaranteeing that your email validation remains online during traffic surges or vendor updates. Enterprise administrators can review custom compliance options and advanced routing controls directly via the AutoSPF enterprise portal.
Relying on manual spreadsheets or occasional manual tests is a common point of failure. To understand why automated tracking is the only reliable path for scaled businesses, read our analysis on Why HubSpot and Salesforce integrations break your SPF record (and how to fix it).
Protect your company's email systems before connecting your sales and marketing databases. Test your domain's current SPF lookup count using our diagnostic tools, and register for a 30-day free trial at AutoSPF to keep your sales and marketing engines running without deliverability interruptions.