SPF record for HubSpot

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

HubSpot's own example (your number will differ)

Type: TXT · Host: @ Copy

v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all

HubSpot and Microsoft 365

Type: TXT · Host: @ Copy

v=spf1 include:spf.protection.outlook.com include:123456.spf03.hubspotemail.net -all

Replace 123456.spf03.hubspotemail.net with the value from your HubSpot account.

HubSpot and Google Workspace

Type: TXT · Host: @ Copy

v=spf1 include:_spf.google.com include:123456.spf03.hubspotemail.net -all

Replace 123456.spf03.hubspotemail.net with the value from your HubSpot account.

How SPF applies to HubSpot mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). HubSpot sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• HubSpot says DNS changes usually take 10 to 70 minutes and can take up to 48 hours.
• Because the include is account-specific, we can't measure its lookup cost in advance. Check your full record with the SPF Checker after publishing it.

How to add it

1. In HubSpot, click the settings icon, then go to Content, Domains & URLs, and connect your email sending domain.
2. HubSpot generates the DNS records to add: an MX record, two CNAMEs for DKIM, a TXT record for SPF and a TXT record for DMARC.
3. If you already have an SPF record, add the part after include: from HubSpot's Required data column to it. Keep a single v=spf1 and a single -all.
4. Wait at least 20 minutes, then check the status in HubSpot (Not authenticated, Partially authenticated or Authenticated) and with the SPF Checker below.

DKIM and DMARC alignment

HubSpot shows a domain as Partially authenticated when DKIM is verified but SPF or DMARC isn't yet, and Authenticated when all three are verified. DKIM uses two CNAME records generated for your account.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. HubSpot's documentation uses -all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Pasting HubSpot's example number (123456) instead of your own account's value.
• Ending up with two v=spf1 strings or two all terms after merging.