Ever had your HubSpot emails land in spam folders or bounce for unknown reasons, even when everything looked set up correctly?
One of the most common culprits behind poor email deliverability is a missing or misconfigured DMARC record.
Even if your SPF and DKIM look valid, without the final piece of authentication, DMARC, email providers might still treat your messages as suspicious. That leads to missed opens, lost leads, and weaker engagement across the board.
In most HubSpot environments, domain authentication is handled early during setup. But if DMARC is skipped or misaligned, newsletters, automations, and transactional emails may never reach the inbox.
This guide explains how to set up a DMARC policy with HubSpot, how it works with SPF and DKIM, what mistakes to avoid, and how to measure the results.
How DMARC Works with HubSpot to Protect Your Email Domain
DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is a protocol that builds on SPF and DKIM to protect your domain’s email traffic.
It is a DNS-level rule that tells receiving servers what to do with messages that claim to be from your domain but fail authentication checks.
HubSpot does not manage DMARC directly. However, it plays a critical role in how DMARC works. When emails are sent through HubSpot using your domain, recipient mail servers validate those messages against your DNS settings, including the DMARC policy you publish.
Domain Authentication Setup:
Your configuration begins in HubSpot under Settings > Domains & URLs > Email Sending Domains. This is where you connect and authenticate your domain.
HubSpot provides SPF and DKIM records that must be added to your DNS. After those records are active, you publish a DMARC record separately to complete authentication.
With this setup, email servers can confirm that messages sent through HubSpot are legitimate and tied to your domain, not impersonation attempts.
How It Works Behind the Scenes
DMARC acts as the enforcement layer for SPF and DKIM. Both protocols depend on each other to function correctly.
When HubSpot sends an email using your domain, the following checks occur:
SPF Check:
The receiving server verifies that HubSpot’s sending IPs are authorized in your SPF record.
DKIM Check:
The server validates the DKIM signature using the public key stored in your DNS.
DMARC Enforcement:
If SPF or DKIM passes and aligns with your domain, the message is accepted. If not, the receiving server follows your DMARC policy to decide the outcome.
The main DMARC policy options include:
- p=none: No enforcement, failures are reported only
- p=quarantine: Messages are routed to spam
- p=reject: Messages are blocked entirely
You can also enable reporting using the rua tag, which sends aggregate reports about your domain’s email activity. These reports help identify unauthorized senders.
DMARC only works when SPF and DKIM are configured correctly. HubSpot supports this alignment when DNS records are implemented accurately.
How HubSpot Email Teams Benefit From DMARC
Marketing Email Authentication
Inbox placement matters for marketing teams using HubSpot. A properly configured DMARC policy strengthens domain credibility with mailbox providers such as Gmail and Outlook.
If a campaign is sent from an address like promo@yourcompany.com, DMARC confirms that only authenticated HubSpot messages are accepted. Fraudulent emails attempting to spoof your domain fail delivery checks, while legitimate campaigns reach recipients as expected.
Transactional and Automation Messages
Transactional emails often contain time-sensitive information.
Examples include event confirmations, workflow alerts, or password resets. When these emails fail delivery, user trust drops quickly.
Aligning DMARC with HubSpot’s SPF and DKIM records protects these messages and keeps system-driven emails reliable.
Managing Multiple Sending Domains
Organizations using multiple domains or subdomains can apply different DMARC policies to each domain or subdomain.
For example, a newer subdomain such as news.brandx.com may start with p=none, while a primary domain enforces p=reject.
HubSpot’s domain tools support this structure while allowing controlled enforcement across brands or departments.
Common Mistakes You Don’t Want to Make
SPF Not Updated With HubSpot Include:
Missing include:hubspotemail.net in your SPF record causes legitimate HubSpot emails to fail authentication.
Multiple DKIM Selectors in DNS:
Old or duplicated DKIM records can conflict. Keep only the active CNAME records provided by HubSpot.
Choosing “Reject” Too Early:
Applying p=reject before auditing all sending sources can cause valid emails to bounce. Monitoring first avoids disruption.
Ignoring Subdomain-Level Policies:
Emails sent from subdomains require their own DMARC records unless explicitly covered by the parent domain’s DMARC record.
Step-By-Step: Setting Up Your DMARC Policy With HubSpot
Prerequisites
- Admin-level access to HubSpot
- DNS access through your domain host
- Verified SPF and DKIM records in HubSpot
Setup Process
- Log in to HubSpot and go to Settings > Domains & URLs > Email Sending Domains. Confirm the domain is verified.
- Copy the SPF and DKIM records provided by HubSpot.
- Log in to your DNS manager.
- Confirm your SPF record includes include:hubspotemail.net and that only one SPF record exists.
- Confirm both DKIM CNAME records match HubSpot’s values. Remove outdated entries.
- Create a DMARC TXT record at _dmarc.yourdomain.com with the following value:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
- Allow DNS propagation to complete.
- Send test emails from HubSpot and review message headers for SPF, DKIM, and DMARC pass results.
- Review DMARC reports weekly and adjust enforcement levels when ready.
Keeping Score: How to Measure Success in HubSpot
Inside HubSpot, review:
- Email performance under Marketing > Email > Analyze
- Bounce rates by error category
- Campaign results before and after DMARC activation
- Open and click-through rate changes
Outside HubSpot, DMARC reports provide insight into:
- Authentication pass rates
- Authorized and unauthorized sending sources
- Policy enforcement behavior
This visibility helps maintain control over your domain’s email reputation.
Real-World Example: Turning Misfires Into Deliveries
An IT administrator at a SaaS company notices customer update emails landing in spam.
After reviewing DNS records, they find missing SPF includes, outdated DKIM entries, and no DMARC record.
They correct the SPF record, update DKIM CNAMEs, and publish a monitoring DMARC policy.
Within a day, authentication passes all checks. Over the following weeks, bounce rates decline and inbox placement stabilizes.
How INSIDEA Helps
Email authentication requires precision. Small DNS errors can affect revenue-critical messages.
INSIDEA supports teams looking to hire HubSpot experts who understand the technical details of SPF, DKIM, and DMARC.
Our HubSpot consulting services cover:
- Domain authentication setup and cleanup
- Multi-domain and subdomain configurations
- Email workflow reliability checks
- Reporting and sender visibility
- Ongoing support for HubSpot email infrastructure
If you need help resolving delivery issues or want a clean, verified setup, INSIDEA provides practical guidance without guesswork.
