How to Create an SPF Record for HubSpot

HubSpot is an all-in-one CRM platform that sends a lot of email on your behalf -- marketing campaigns, sales sequences, automated workflows, and CRM notifications. If you're using HubSpot to reach customers and prospects, those emails need to pass authentication checks. Without an SPF record authorizing HubSpot, receiving mail servers may flag your messages as suspicious and route them to spam.

This guide walks you through creating the correct SPF record for HubSpot so every email -- whether it's a marketing blast or a one-to-one sales email -- lands in the inbox.

The SPF Include Value for HubSpot

Here's the include you need for HubSpot:

include:spf.hubspot.com

A complete SPF record with only HubSpot looks like this:

v=spf1 include:spf.hubspot.com -all

Step-by-Step: Creating Your HubSpot SPF Record

Common SPF Record Combinations With HubSpot

Most HubSpot users also have a primary email provider for day-to-day communication. Here are the most common setups:

Verifying Your HubSpot SPF Record

Once DNS changes have propagated, verify that everything is working correctly.

Go to SPF Record Check and enter your domain. The tool will show your published SPF record, validate the syntax, check for duplicate records, and count DNS lookups. Confirm that include:spf.hubspot.com appears in the record and that no errors are flagged.

You can also check the status inside HubSpot. After adding DNS records, go back to your domain settings in HubSpot and click the verification button. HubSpot will check your DNS and confirm whether the SPF record (and DKIM records) are correctly published. If something is wrong, HubSpot will tell you what's missing.

For a hands-on test, send a marketing email or sales sequence message from HubSpot and inspect the email headers on the receiving end. Look for Authentication-Results: spf=pass to confirm everything is working.

Common HubSpot SPF Mistakes

Confusing HubSpot's SPF Include With Other HubSpot Domains

HubSpot uses many domains for different purposes -- tracking links, landing pages, forms, and more. The correct SPF include is spf.hubspot.com. Don't use hubspot.com, hubspot.net, or any tracking domain you might see in email headers. Only spf.hubspot.com authorizes HubSpot's mail servers.

Creating a Second SPF Record

This is the most common DNS mistake across all email providers. If you already have an SPF record for Google Workspace or Microsoft 365, don't create a new TXT record for HubSpot. Two SPF records on the same domain cause a permerror that breaks SPF entirely. Edit your existing record and add the HubSpot include alongside your other providers.

Not Connecting Your Domain in HubSpot

Adding the SPF record to your DNS is only half the setup. You also need to connect and verify your sending domain inside HubSpot's settings. Without this step, HubSpot may send emails using a shared HubSpot domain, which means your SPF record won't apply to those messages. Make sure you complete the domain connection process in HubSpot so emails go out as your domain.

Forgetting About Sales Email

HubSpot's sales tools -- sequences, one-to-one emails sent through the CRM -- also send email on behalf of your domain. The same spf.hubspot.com include covers these. But if your sales team connects their personal email accounts (like Gmail) to HubSpot, those emails may route through Google's servers instead. Check how your sales team's email is configured to make sure SPF covers the right sending path.

Complete Your Email Authentication

SPF tells receiving servers which IP addresses can send email for your domain, but it's only one layer of protection. For full email authentication, you need all three protocols working together:

• DKIM adds a cryptographic signature to each outgoing message. HubSpot supports custom DKIM by having you add CNAME records to your DNS. Use DKIM Creator to generate your DKIM configuration.
• DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication. Use DMARC Creator to build your DMARC policy.

Setting up all three protocols is the best way to protect your domain from spoofing and maximize your inbox placement rates.