SPF for HubSpot: Setup Guide and Common Issues

HubSpot is one of the most popular CRM and marketing platforms, and if you're using it to send emails — whether marketing campaigns, sales sequences, or transactional notifications — you need to make sure those emails authenticate properly. Setting up SPF for HubSpot ensures that receiving servers recognize your HubSpot emails as legitimate.

For a comprehensive overview of SPF, see our complete SPF guide. This guide covers everything you need to know, including HubSpot's specific approach to email authentication and the steps to get it right.

How HubSpot Handles Email Authentication

Before diving into the setup, it's important to understand that HubSpot's approach to email authentication is a bit different from services like SendGrid or Mailchimp.

HubSpot primarily relies on DKIM for authentication (HubSpot Knowledge Base). When you connect your sending domain in HubSpot, the main records you add are DKIM CNAME records. This is because HubSpot's DKIM setup handles the heavy lifting of email authentication.

SPF setup depends on your IP type:

• Shared IPs (most HubSpot users): Your emails are sent from HubSpot's shared pool of IP addresses. HubSpot manages the SPF configuration on their end through the Return-Path domain. In many cases, you don't need to add a separate SPF include for HubSpot's shared IPs.
• Dedicated IPs (HubSpot Marketing Hub Enterprise): If you have a dedicated sending IP from HubSpot, you'll need to configure SPF specifically for that IP or include.

Connecting Your Sending Domain in HubSpot

The first step — regardless of whether you need SPF — is connecting your sending domain in HubSpot's settings. This is where HubSpot gives you the DNS records to add.

Adding SPF for HubSpot

If HubSpot's documentation or support team has provided you with a specific SPF include value for your account, here's how to add it to your SPF record.

If you don't have an existing SPF record

Create a new TXT record with HubSpot's include. For example:

v=spf1 include:mail.hubspot.net ~all

If you already have an SPF record

Add HubSpot's include to your existing record. Don't create a second SPF record.

Before:

v=spf1 include:_spf.google.com ~all

After:

v=spf1 include:_spf.google.com include:mail.hubspot.net ~all

If you have a dedicated IP from HubSpot

With a dedicated sending IP, you may be able to use an ip4 mechanism instead of an include, which saves on DNS lookups:

v=spf1 include:_spf.google.com ip4:YOUR.DEDICATED.IP ~all

Your HubSpot account manager can confirm your dedicated IP address. Using ip4 directly doesn't count toward the 10 DNS lookup limit, which can be helpful if you're using many email services.

Common HubSpot SPF Issues

HubSpot emails failing SPF

If your HubSpot emails are failing SPF checks, here are the most common causes:

You haven't connected your sending domain. You must connect and verify your domain inside HubSpot's settings. Without this, HubSpot may use its own domain in the Return-Path, meaning your SPF record isn't checked.

The SPF include value is wrong. Double-check the exact include value against HubSpot's current documentation.

DNS propagation isn't complete. After changing DNS records, allow up to 48 hours for full propagation. Most changes take 1-4 hours.

You have multiple SPF records. Your domain can only have one TXT record starting with v=spf1. A second SPF record causes a PermError.

Emails going to spam despite SPF pass

SPF is just one factor. Also check: Is DKIM configured? Do you have a DMARC record? Is your sender reputation healthy (low bounces, no spam complaints)? Review your full setup with an SPF record audit.

HubSpot and DMARC alignment

For DMARC to pass, either SPF or DKIM must align with your From domain. Since HubSpot's DKIM setup aligns with your domain by default, DMARC typically passes through DKIM alignment even if SPF alignment isn't perfect.

HubSpot with Other Email Services

Most businesses use HubSpot alongside other email services. Combine them in a single SPF record:

HubSpot + Google Workspace:

v=spf1 include:_spf.google.com include:mail.hubspot.net ~all

HubSpot + Microsoft 365:

v=spf1 include:spf.protection.outlook.com include:mail.hubspot.net ~all

Each include adds to your DNS lookup count. If you're using multiple services, check your total with the tool above to stay under the 10 DNS lookup limit. Need help building the record? SPF Creator can generate the correct syntax.

Complete Email Authentication for HubSpot

For the strongest deliverability, set up all three authentication protocols: SPF (what this article covers), DKIM (HubSpot's primary method, set up through domain connection), and DMARC (tells receivers how to handle authentication failures). Together, these protect your domain from spoofing and improve inbox placement.

Verifying Your Setup

After making changes, verify everything is working:

1. Check your SPF record with the tool above. Confirm the record is valid and includes HubSpot's authorization.

2. Check HubSpot's domain verification. In HubSpot settings, your domain should show as verified with green checkmarks.

3. Send a test email. Send an email from HubSpot to a Gmail address. Open it, click the three dots, and select "Show original." Look for spf=pass and dkim=pass in the authentication results.

Monitor Your SPF Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.

References

• RFC 7208: Sender Policy Framework (SPF) — The current SPF specification
• HubSpot: Connect Your Email Sending Domain — Official HubSpot email authentication guide