Library  /  Lifecycle

I read the SPF records of 52 SaaS companies. Their lifecycle marketing leaves through three platforms, at the median.

A lifecycle diagram shows one journey in one tool. The DNS of the same company shows the welcome, the receipt, the support reply and the survey leaving from different systems that do not share an unsubscribe list.

Ilona Reichert · Deliverability engineer  /  October 1, 2026  /  5 min read  /  7 sources
What this piece concludes
  • Of 49 SaaS domains with readable SPF, the median one authorises 3 outside platforms to mail its customers. 31 of 49 authorise three or more.
  • monday.com authorises 7 customer-facing senders, among them three marketing tools: HubSpot, Mailchimp and GetResponse.
  • 13 of 49 run marketing, product mail and support through separate platforms, and an unsubscribe in one reaches the others only if someone wires them together.
  • At 22 of 52 companies at least one sender only shows up on a subdomain like mail. or email., which an inventory of the main record misses.
  • Zendesk appears at 24 companies, more than any marketing platform. Support replies are part of the program whether the lifecycle team owns them or not.

Every lifecycle marketing diagram I have drawn shows one journey inside one tool: signup, welcome, day three nudge, trial ending, upgrade. The customer never gets that journey. They get a welcome from one system, a receipt from a second, a support reply from a third and a survey from a fourth.

I wanted to know how many systems that really is, so I read it off the one place every company has to publish it.

SPF is a DNS record listing who may send mail as your domain. Each outside platform needs its own include line, so the record doubles as a public list of who writes to your customers in your name. On 24 September I read it for 52 SaaS companies, on the main domain and on eleven common mail subdomains, following every include the way a receiving server does. Then I set aside staff mail (Google Workspace, Microsoft 365, security gateways) and HR or training tools, and counted what was left: platforms that write to customers.

Three companies gave nothing readable. Canva lists only its own IP ranges, HubSpot only its own product, and Twilio hides everything behind a flattening service.

The other 49 had a median of three.

Customer-facing senders, 49 SaaS domains, 24 September 2026

31 of the 49 authorise three or more. 16 authorise four or more. monday.com authorises seven: GetResponse, HubSpot, Mailchimp, Mailgun, Qualtrics, Salesforce and Zendesk. Three of those are marketing tools.

It is not unusual. Ten companies authorise two or more marketing platforms. Zoom has Mailchimp, Pardot and Salesforce Marketing Cloud side by side, and GitHub has Mailchimp next to Marketo. Thirteen run marketing, product mail and support through three separate systems.

The most common name was not a marketing platform at all. Zendesk shows up at 24 companies, ahead of Marketo, SendGrid and Salesforce at 17 each.

What three senders do to a lifecycle marketing program

Each platform keeps its own unsubscribe list. Somebody who leaves the newsletter in Marketo is still a contact in the Qualtrics survey and in whatever sends the trial reminders. Google’s FAQ expects unsubscribes honoured within 48 hours, and the US CAN-SPAM Act gives 10 business days. Neither rule cares which of your tools received the click.

Frequency has the same problem. A welcome from HubSpot, a receipt from Amazon SES and a support follow-up from Zendesk can land on the same morning, and no single tool can see all three to hold one back.

Reputation is shared. Gmail tracks the spam rate of your domain and wants it below 0.10%. Complaints about a newsletter count against the domain that sends your password resets.

Much of this is easy to miss. At 22 of 52 companies at least one sender appeared only on a subdomain record. Notion’s main record authorises nobody; Mailgun and Marketo sit on mail.notion.so.

What to check in your own account

Run dig +short TXT yourdomain.com, then repeat for every subdomain your mail uses: mail, email, em, e, go, info, hello, updates. Write each include on its own line.

Next to each line, write the messages that platform sends and the name of the person who owns it. The welcome series usually sits in one tool and the receipts in another. If a line has no owner, it is probably a vendor you stopped paying.

Then pick one list to hold every unsubscribe and sync the others to it. Most platforms accept a suppression import or an API call. It is the rule from the CRM automation guide applied to one field: decide which system owns it and make the others read from it.

Last, put the sends of every tool on one calendar for a single test contact and look at one week. A stop condition from the drip timing lesson only works if every sender reads it.

What the records could not tell me

An include is permission, not proof. It does not say whether the platform sent anything this year, and old lines survive long after a contract ends. Some platforms send with their own bounce domain and never need a line in your record, so the real count is probably higher than mine. Five companies hide some or all of their senders behind flattening services such as Valimail and AutoSPF.

The detail I keep coming back to is Qualtrics. Seven companies authorise it, Slack and Stripe among them, which means a survey leaves in their name from a tool the lifecycle team may never log into. I could not find out whether leaving Slack’s marketing list stops that survey. The record says Qualtrics may send. It says nothing about who tells Qualtrics you left.

Questions people ask about this

What counts as lifecycle marketing email?

Every message a customer gets because of where they are in their relationship with you: welcome, onboarding nudges, receipts, renewal notices, win-back, satisfaction surveys. In our sample those left through three platforms at the median, so the program is usually wider than the tool the lifecycle team logs into.

Does unsubscribing in one tool stop mail from the others?

Not unless someone connects them. Each platform keeps its own suppression list. Google expects unsubscribe requests to be honoured within 48 hours, and the US CAN-SPAM Act allows 10 business days, and neither cares which of your tools was asked.

Are receipts and password resets covered by unsubscribe rules?

Mostly not. CAN-SPAM treats transactional or relationship messages differently from commercial ones, and Gmail's one-click unsubscribe requirement applies to marketing and subscribed messages. A receipt with a promotion in it can cross that line.

How do I list every tool that sends as my domain?

Run dig TXT on your domain and on the subdomains your team uses for mail, then follow every include. In our sample 22 of 52 companies had a sender that only appeared on a subdomain record.

Why does it matter which tool sends if all of them pass authentication?

Gmail tracks the spam rate for your domain, and the guideline is to stay below 0.10% and never reach 0.30%. Complaints about a newsletter sent from one platform count against the same domain your receipts use.

Read next
Transport security
Three of thirty companies tell the internet to encrypt their mail. On one of the three, the instruction cannot be read.
Authentication
All thirty domains I checked enforce DMARC. Seventeen of them sit on an SPF record that fails soft.
Before your next send

Run the same check on your own domain. It reads live DNS, the same records Gmail reads, and tells you which of the three is missing.

Check your domain free → Open the glossary