Add Mailchimp, HubSpot or Shopify to SPF Without Breaking It

Every marketing, invoicing, and e-commerce tool asks you to "add us to your SPF record". Do that four or five times without thinking and your record silently breaks, because SPF allows at most ten DNS lookups and each include: mechanism spends one or more of them. Here is how to add a sender correctly, how to count what you have already spent, and when you should not add the sender to SPF at all.

Quick answer

Only one SPF record may exist per domain, so you edit the existing TXT records (short text lines in DNS used for email security) rather than adding a second. Insert the tool's include: before the ~all at the end. Before you do, count lookups: include:, a:, MX (Mail Exchanger — where incoming email is delivered):, redirect=, and exists: each cost one, and nested includes inside a tool's record count too. If you are at eight or nine, stop and use a subdomain or DKIM-only alignment for that tool instead.

Your starting point

If your domain is hosted with OquMail your root TXT records (short text lines in DNS used for email security) is:

yourdomain.com  TXT  "v=spf1 mx a:mail.oqumail.com ~all"

That record spends two lookups: MX (Mail Exchanger — where incoming email is delivered) and a. The a: mechanism with a hostname is a lookup; ip4: and ip6: cost nothing. You have eight left, which is plenty if you spend them deliberately.

Adding a sender step by step

1. Find the tool's SPF value in its own documentation or its domain-authentication settings page. It will look like include:servers.mcsv.net (Mailchimp) or include:shops.shopify.com (Shopify). HubSpot gives you a per-account include on its connected-domain page.
2. Open your DNS host and edit the existing TXT records (short text lines in DNS used for email security) at the root. Do not create a second TXT starting with v=spf1; two SPF records is itself a permanent error.
3. Insert the include immediately before the ~all: v=spf1 MX (Mail Exchanger — where incoming email is delivered) a:mail.oqumail.com include:servers.mcsv.net ~all.
4. Save and wait for the TTL to expire. Then check the record at a free SPF lookup tool that reports the lookup count, not just the syntax.
5. Send a test from the tool to a Gmail address and open Show original. Look for SPF (Sender Policy Framework — a list of servers allowed to send email as your domain)=pass and check which domain it passed for.

How to count lookups you have already spent

• Each include: costs one, plus everything inside it. Some vendor includes chain three or four further includes, so one line can cost five.
• mx costs one, plus one per MX hostname it resolves. a with a hostname costs one. redirect= and exists: cost one each.
• ip4: and ip6: cost zero. all costs zero.
• Void lookups (an include pointing to a hostname with no record) also count against a separate limit of two; a stale include for a tool you cancelled can fail you this way.

The important question: does this tool need SPF at all?

SPF authenticates the envelope sender (Return-Path), not the visible From address. Most marketing tools use their own bounce domain in the Return-Path, so SPF passes for their domain, not yours, and does not align for DMARC. DKIM signed with your domain is what makes those tools pass DMARC. If a tool offers custom-domain DKIM (Mailchimp, HubSpot, and Shopify all do), set that up first. Adding the SPF include is then a nice-to-have, and skipping it saves your lookups for tools that genuinely send with your domain in the Return-Path.

Two ways to stay under the limit when you have many tools

1. Move bulk senders to a subdomain. Send newsletters from news.yourdomain.com with its own SPF record and DKIM key. Each subdomain gets its own ten lookups and its own reputation, so a marketing blip does not hurt invoice delivery from your root domain.
2. Flatten a stable include. Replace include:vendor.example with the ip4: and ip6: ranges it resolves to. This costs zero lookups but breaks the moment the vendor changes IPs, so only do it for vendors that publish stable ranges and note the review date in your DNS records.

Pitfalls

• Using -all (hard fail) before every sender is confirmed. Stay with ~all until DMARC reports show everything aligned.
• Leaving includes for cancelled services. Each one is a lookup you are paying for and a server someone else now controls.
• Adding SPF for a tool that sends "on behalf of" your address through its own domain. It will never align; it needs DKIM.
• Pasting the include with a trailing dot or a space that splits the record into two TXT strings incorrectly.

Common questions

What does PermError actually do to my mail?

Receivers treat a record they cannot evaluate as if it did not exist. SPF stops contributing to DMARC, so if DKIM is also missing on any sender, that mail fails DMARC and, under a quarantine or reject policy, goes to spam or bounces.

Can I put the tool on its own subdomain but keep the From address on my root domain?

The visible From and the authenticating domain must align for DMARC. In relaxed mode a subdomain aligns with its parent, so sending From news.yourdomain.com aligns with yourdomain.com's DMARC policy. Sending From yourdomain.com while authenticating as the vendor's domain does not.

Does OquMail count against my lookups when I also use a marketing tool?

Two lookups (MX (Mail Exchanger — where incoming email is delivered) and a). Transactional mail sent through the OquMail API or SMTP is signed with your domain's DKIM key as well, so it aligns on both checks.