Let’s talk about something that’s not super glamorous—but absolutely essential: email authentication.

If you’ve ever scratched your head over email deliverability issues in HubSpot, or wondered why some of your beautifully crafted marketing emails are ending up in the spam folder, chances are high you’ve run into the world of SPF, DKIM, and DMARC—whether you knew it or not.

So, let’s clear up the fog.

In this guide, we’re diving deep into HubSpot marketing email SPF and DMARC, what these terms mean, why they matter for your business, and how you can configure your email sending domain in HubSpot to maximize email deliverability.

HubSpot Marketing Email SPF and DMARC – What They Even Are?

First off, what is SPF?

SPF (Sender Policy Framework) is like a guest list for your domain’s outgoing emails.

It tells the world: “Only these servers are allowed to send emails on behalf of my domain.”

Without a proper HubSpot SPF record, your emails could be marked as suspicious—because, let’s be real, spam filters are harsh these days.

And DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM (we’ll get to that in a sec).

Think of DMARC as the bouncer at the club.

It checks if the email is really coming from you (i.e., your verified domain), and if it’s not—depending on your policy—it can reject or quarantine it.

TL;DR: Setting up HubSpot marketing email SPF and DMARC properly protects your brand, boosts email deliverability, and keeps you out of spam folders.

What About DKIM?

Ah yes, HubSpot DKIM (DomainKeys Identified Mail). It works a bit differently than SPF.

It uses encryption to attach a digital signature to your email, proving it really came from your domain. If SPF is the guest list, DKIM is like a secret handshake.

In HubSpot, when you verify your email sending domain, you’re essentially setting up both SPF and DKIM.

How Email Authentication Works in HubSpot

Here’s the deal. When you send marketing emails through HubSpot, you’re technically using their servers to send on behalf of your domain. And that’s where SPF, DKIM, and DMARC come in.

To make sure email providers (like Gmail, Outlook, etc.) trust that these HubSpot emails really come from you, you need to connect and authenticate your HubSpot email sending domain.

So what happens if you don’t set this up?

• Your emails might get marked as spam.

• They might not be delivered at all.

• Your domain reputation can take a hit.

• Your email engagement drops—and so does your ROI.

But don’t panic. This is fixable.

Step-by-Step: How to Set Up SPF, DKIM & DMARC for HubSpot Emails

Let’s walk through the full setup, broken down for real humans (no jargon soup).

1. Add Your Email Sending Domain in HubSpot

Go to Settings → Website → Domains & URLs.

Click Connect a domain and select Email Sending.

This is where you tell HubSpot, “Hey, I want to send marketing emails from yourdomain.com.”

This kicks off the HubSpot email verification process.

2. HubSpot Gives You DNS Records

Once you start the domain connection, HubSpot will show you three CNAME records. These include:

• One for SPF

• Two for DKIM

You’ll need to copy these and paste them into your domain’s DNS settings (usually through your DNS provider like GoDaddy, Cloudflare, Namecheap, etc.)

Bonus: What’s in a HubSpot SPF record?

Technically, it’s a CNAME that points to spf.hubspotemail.net, which then includes HubSpot’s mail servers in your domain’s SPF policy.

If you’re using other platforms to send email (like Gmail, Mailchimp, etc.), make sure they’re all included in a single SPF record. SPF doesn’t like duplicates.

3. Add a DMARC Record (Manually)

HubSpot doesn’t provide a DMARC record for you (yet), but you should totally set one up. You do this in your DNS settings by adding a TXT record like this:

Host/Name: _dmarc
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com;

You can tweak the policy (p=none, quarantine, or reject) depending on how strict you want to be. Most people start with none and ramp up over time.

How Do I Change Email Sending Domain in HubSpot?

Good question—and it comes up a lot.

If you’re already using one domain and want to switch (say you rebranded or want to send from a subdomain), just go back to Settings → Domains & URLs, and connect a new email sending domain.

Make sure to:

• Remove or update old DNS records.

• Verify the new domain in HubSpot.

• Update email templates and workflows to reflect the new “From” address.

Pro tip: Always test emails after the switch to ensure SPF and DKIM pass on services like MxToolbox or GlockApps.

Wait—What About Subdomains vs Root Domains?

HubSpot recommends using a subdomain (like email.yourdomain.com) as your HubSpot email sending domain instead of the root domain. Why?

• It keeps your main domain’s reputation safe.

• It gives more control over email authentication settings.

• It helps separate marketing and transactional emails.

How to Change Email Preference Domain Setting in HubSpot

So this one’s a bit different, but still tied into email hygiene.

The email preference page is what people see when they click “unsubscribe” or “manage preferences” from your marketing emails.

You can customize the URL for this page under:

Settings → Marketing → Email → Subscription Types → Configuration.

By default, it uses a HubSpot subdomain like hs-emaildomain.hubspotpagebuilder.com, but you can map this to a custom subdomain, too—like preferences.yourdomain.com.

It’s another trust signal for your users, and it keeps everything on-brand.

Best Practices for HubSpot Email Sending Domains

Let’s recap the essentials and throw in a few pro tips:

Always verify your domain

Without verification, your email authentication settings won’t work—and your deliverability tanks.

Use a dedicated subdomain

It’s cleaner, safer, and more professional.

Use one SPF record

If you’re using multiple tools to send email, make sure all servers are included in one SPF entry.

Add a DMARC record

Even if you start with p=none, it’s better than nothing—and gives you valuable reporting.

Monitor your domain

Use tools like DMARCian, Postmark, or Valimail to watch for spoofing or delivery issues.

Troubleshooting Common Issues

Emails still going to spam?

Check your authentication results using Gmail’s original message view. Look for:

• SPF: PASS

• DKIM: PASS

• DMARC: PASS

If any of these fail, revisit your DNS settings.

HubSpot says domain not verified?

Double-check:

• You added the correct CNAME records

• DNS changes have propagated (can take up to 24-48 hours)

• There are no conflicting records (like two SPF entries)

Email Sending Domain HubSpot – Conclusion

Setting up HubSpot marketing email SPF and DMARC isn’t just some technical checkbox—it’s important for getting your emails seen and clicked.

Still feeling unsure? Don’t hesitate to reach out because your emails deserve to land in inboxes, not spam folders.

How to Change Email Preference Domain Setting HubSpot – FAQs

Do I need both SPF and DMARC in HubSpot Free CRM?

Yes, having both SPF and DMARC is highly recommended—even with HubSpot Free CRM—to ensure your marketing and sales emails are authenticated, reducing the chance of being marked as spam.

Does DMARC override SPF in HubSpot?

No, DMARC doesn’t override SPF—it works with SPF and DKIM. DMARC simply instructs how to handle emails that fail SPF or DKIM checks.

How do I authenticate emails in HubSpot received with SPF DKIM and DMARC alignment?

To authenticate emails, connect your domain in HubSpot and update your DNS with the DKIM CNAME records provided.

HubSpot manages DKIM; you must configure SPF and DMARC manually in your domain’s DNS.

Relevant Guides

How to Create a Deal in HubSpot

Is a HubSpot Module a Widget?

How to Build an Accordion HubSpot Module

How to Send HubSpot Metrics to Google Analytics

How to Force Only One Accordion Open in HubSpot

What is Associated Sync Error in HubSpot

Can You Access HubSpot Without Internet Access