# SPF record for HubSpot

URL: https://iblockspam.com/spf/hubspot
Last updated: 2026-10-09

Include: Account-specific (copy from HubSpot)
Where it goes: Your email sending domain (@)
DNS lookups: depends on your account

HubSpot generates an SPF include for your account when you connect an email sending domain, in the form include:123456.spf03.hubspotemail.net. Copy the exact value from HubSpot's domain settings and add it to your existing SPF record, for example v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all. Don't copy someone else's number.

## Example records

- HubSpot's own example (your number will differ) (TXT, host @): `v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all`
- HubSpot and Microsoft 365 (TXT, host @): `v=spf1 include:spf.protection.outlook.com include:123456.spf03.hubspotemail.net -all` Replace 123456.spf03.hubspotemail.net with the value from your HubSpot account.
- HubSpot and Google Workspace (TXT, host @): `v=spf1 include:_spf.google.com include:123456.spf03.hubspotemail.net -all` Replace 123456.spf03.hubspotemail.net with the value from your HubSpot account.

## Notes

- HubSpot says DNS changes usually take 10 to 70 minutes and can take up to 48 hours.
- Because the include is account-specific, we can't measure its lookup cost in advance. Check your full record with the SPF Checker after publishing it.

## How to add it

- In HubSpot, click the settings icon, then go to Content, Domains & URLs, and connect your email sending domain.
- HubSpot generates the DNS records to add: an MX record, two CNAMEs for DKIM, a TXT record for SPF and a TXT record for DMARC.
- If you already have an SPF record, add the part after `include:` from HubSpot's Required data column to it. Keep a single `v=spf1` and a single `-all`.
- Wait at least 20 minutes, then check the status in HubSpot (Not authenticated, Partially authenticated or Authenticated) and with the SPF Checker below.

## DKIM and DMARC

HubSpot shows a domain as Partially authenticated when DKIM is verified but SPF or DMARC isn't yet, and Authenticated when all three are verified. DKIM uses two CNAME records generated for your account.

## Common mistakes

- Pasting HubSpot's example number (123456) instead of your own account's value.
- Ending up with two `v=spf1` strings or two `all` terms after merging.

**Q: What is HubSpot's SPF include?**
It is specific to your account and looks like `include:123456.spf03.hubspotemail.net`. Find it in HubSpot under Settings, Content, Domains & URLs, in the Required data column for your email sending domain.

**Q: How do I add HubSpot to an existing SPF record?**
Add HubSpot's value after `include:` to your current record, so it still starts with one `v=spf1` and ends with one `all`. For example: `v=spf1 include:spf.protection.outlook.com include:123456.spf03.hubspotemail.net -all`.

**Q: Why does HubSpot say my domain is partially authenticated?**
HubSpot shows Partially authenticated when DKIM is set up and verified but SPF or DMARC still needs to be verified. Check that the SPF include and the `_dmarc` record are published, then verify again.

Sources:
- HubSpot Knowledge Base: Manage email authentication in HubSpot: https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot

---

Source: iBlockSpam, https://iblockspam.com/spf/hubspot (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt