SPF Setup for CRM Senders Like HubSpot and Salesforce

December 24, 2025 • InboxGreenEmail Team

🚨 DKIM issues can silently kill replies.

If opens dropped, replies disappeared, or bounces increased, treat it as an incident. Run the scan and get a fix path.

No signup required. Works on any domain.

search Run a Free Domain Check notifications_active Monitor my domain

Introduction

Setting up SPF for your email sending domains is crucial, especially if you are using CRM platforms like HubSpot or Salesforce. If you skip this step, you risk having your emails land in spam folders or, worse, being bounced back entirely. This can seriously impact your inbox placement and domain reputation. You may start noticing issues when emails are not reaching your leads, or you receive warnings in Gmail about authentication failures.

When you see bounced emails or find your messages in the spam folder, it becomes urgent to address SPF setup. The good news is that with the right configuration, you can significantly improve your email deliverability. Let’s dive into how to get your SPF records right for CRM senders.

At a glance

  • This problem affects SaaS founders and marketers using CRM platforms.
  • This article will guide you through SPF setup for HubSpot and Salesforce.
  • You will improve your email deliverability and protect your domain's reputation.

When this problem shows up in real life

Imagine you send out a marketing email through HubSpot, but a significant number of recipients report that they never received it. You check your email logs and see entries like this:

550 5.7.1 : Sender address rejected: Domain not found

This indicates that your SPF record might be missing or incorrectly configured. Another scenario could be receiving a support ticket stating:

Emails sent from @yourdomain.com are landing in spam.

Upon checking the headers of one of those emails, you find:

Authentication-Results: mx.google.com; spf=fail (google.com: domain of [email protected] does not designate 203.0.113.1 as permitted sender) [email protected]

This failure means your SPF record is not set up correctly for the IP address used by your CRM. These real world examples highlight the importance of having a properly configured SPF record.

Step by step: SPF setup for HubSpot and Salesforce

  1. Identify your sending domains.

    Determine which domains you will be sending emails from. For example, if you are using yourdomain.com, ensure this is the domain you will configure.

  2. Access your DNS settings.

    Log in to your domain registrar or hosting provider where your DNS settings are managed. This could be GoDaddy, Namecheap, or another provider.

  3. Create or update your SPF record.

    If you do not have an SPF record, you will need to create one. If you do have one, you will need to update it to include the CRM services you are using.

    • For HubSpot, the SPF record typically looks like this:
      • v=spf1 include:hubspot.com -all
    • For Salesforce, you might see:
      • v=spf1 include:_spf.salesforce.com -all
    • If you are using both, combine them:
      • v=spf1 include:hubspot.com include:_spf.salesforce.com -all
  4. Save your changes and allow for DNS propagation.

    Once you save your SPF record, it can take some time for changes to propagate. This usually takes a few hours but may take up to 48 hours in some cases.

  5. Test your SPF record.

    Use the InboxGreen checker to verify that your SPF record is correctly configured. This tool will help identify any issues.

Common mistakes

  • Missing SPF record.

    What you see: Emails are bouncing back with a "domain not found" error.

    Why it is a problem: Without an SPF record, receiving servers cannot verify your email’s authenticity.

    What to change: Create an SPF record as shown above.

  • Incorrect syntax.

    What you see: Emails land in spam folders.

    Why it is a problem: A typo or incorrect format in your SPF record can lead to failures.

    What to change: Double-check your SPF record syntax using a validator.

  • Not including all sending services.

    What you see: Some emails are delivered, while others are rejected.

    Why it is a problem: If you forget to include a service like Salesforce or HubSpot, emails sent from those platforms will fail SPF checks.

    What to change: Ensure all relevant services are included in your SPF record.

  • Using multiple SPF records.

    What you see: SPF failures in email headers.

    Why it is a problem: You can only have one SPF record per domain. Multiple records lead to confusion for receiving servers.

    What to change: Combine all your SPF rules into a single record.

Troubleshooting when it still fails

If you have set up your SPF record but are still facing issues, here are some things to check:

  • Emails are still landing in spam.

    Likely cause: Other authentication methods like DKIM or DMARC may not be set up correctly.

    What to try next: Check your DKIM and DMARC records using the DKIM Checker.

  • SPF still failing in email headers.

    Likely cause: The sending IP address is not included in your SPF record.

    What to try next: Review your SPF record for any missing IPs or services.

  • Authentication-Results showing SPF=none.

    Likely cause: No SPF record found for your domain.

    What to try next: Verify your DNS settings and ensure the SPF record is published.

Related checks you should run

Once you have your SPF record set up, consider checking the following:

  • DKIM and DMARC alignment to ensure all authentication methods are in place.
  • DNS TTL settings and propagation delays to avoid stale records.
  • Domain reputation, including bounces and spam reports, to maintain a healthy sending domain.
  • List quality and engagement patterns to improve deliverability further.

FAQ

Why is SPF still failing on HubSpot after I added the record?

This could be due to DNS propagation delays. Changes can take up to 48 hours to fully propagate. Check your DNS settings and use the InboxGreen checker to confirm the SPF record is visible.

How long do DNS changes take to apply on Salesforce?

Typically, DNS changes can take anywhere from a few minutes to 48 hours. It depends on your DNS provider's TTL settings. Always check with your provider for the most accurate information.

Can I use more than one SPF include with this setup?

Yes, you can include multiple services in your SPF record, but ensure you do not exceed the 10 DNS lookup limit for SPF. Combine them properly to maintain a single SPF record.

What should I do if my SPF record is too long?

If your SPF record exceeds the character limit, consider using subdomains or consolidating your includes. Make sure to keep it under the 255-character limit for DNS records.

What to do next

Now that you have a clear understanding of SPF setup for CRM senders, it is time to take action. Start by verifying your SPF record using the InboxGreen checker. This tool will help you identify any issues quickly. After that, consider setting up DKIM and DMARC for additional layers of email authentication. You can use our DMARC generator to create a DMARC record easily.

By taking these steps, you will enhance your email deliverability and protect your domain's reputation. Don't wait for issues to arise; be proactive and set your email up for success.

Need a clean record fast? Use our SPF generator, then validate with /check.

Free Deliverability Scan

Check SPF, DKIM, DMARC and List-Unsubscribe for your domain in seconds.