When your emails start landing in spam or disappearing entirely, it’s not just frustrating—it can disrupt campaigns, skew reporting, and leave teams scrambling for answers. A major culprit is often misconfigured email authentication settings in HubSpot.
Whether you’re in IT, managing sales infrastructure, or leading marketing operations, inbox placement issues, DKIM or SPF warnings, and disappearing emails are common. These usually stem from DNS records that weren’t fully aligned during setup or have drifted over time.
This guide walks through how to diagnose and correct HubSpot email authentication issues, explains how SPF and DKIM work, highlights common mistakes, and shows how to regain reliable inbox placement.
Understanding Email Authentication in HubSpot
Email authentication verifies that your domain authorizes HubSpot to send emails on your behalf. HubSpot uses two main DNS records:
- SPF (Sender Policy Framework): Lists the IPs allowed to send emails from your domain.
- DKIM (DomainKeys Identified Mail): Adds an encrypted signature to each email to verify it hasn’t been tampered with.
When configured correctly, these records prove to recipient servers that your emails are legitimate and not spam or phishing attempts. You can also implement DMARC for an added layer of enforcement, tying SPF and DKIM together.
Where to find settings in HubSpot:
Go to Settings > Domains & URLs > Email Sending Domains. Domains you connect for outbound emails display SPF and DKIM status. Warnings indicate misconfigurations that could harm deliverability.
Proper authentication is essential for marketing campaigns, automated sequences, one-to-one sales emails, and system notifications. Even small DNS errors can affect thousands of contacts, reduce open rates, and distort engagement metrics.
How Email Authentication Works Under the Hood
Authentication is essentially a handshake between your domain and HubSpot:
- Connect your sending domain in HubSpot.
- HubSpot generates DKIM CNAME records and provides SPF instructions.
- Add the records to your DNS provider (Cloudflare, GoDaddy, etc.).
- Recipient servers verify emails against these records.
SPF confirms your sending IP is authorized.
DKIM ensures the email content hasn’t been altered.
DMARC enforces policy and tells inboxes to trust only properly authenticated messages.
You can authenticate multiple subdomains separately, ensuring each department or brand maintains its own sender reputation.
Main Uses Inside HubSpot
1. Confirm Marketing Email Deliverability
Bulk sends rely on SPF and DKIM for inbox placement. Without proper authentication, emails may appear to be “via hubspotemail.net” or be flagged as suspicious.
Example: A newsletter to 10,000 subscribers experiences soft bounces from Gmail due to DKIM mismatches. Re-authenticating the domain fixes SPF/DKIM issues, and the next send sees open rates recover.
2. Verify Sales and Sequence Emails
Automated sales sequences use the same authentication. If misconfigured, emails can disappear or end up in spam. By including HubSpot sending IPs in SPF records for all subdomains, sequences are tracked properly and delivered reliably.
3. Maintain Domain Integrity Across Teams
Multiple teams sending from the same HubSpot instance need separate authentication for each subdomain. Failure to do so can reduce inbox placement for all departments.
Example: If support.yourdomain.com emails are sent unauthenticated and marked as spam, marketing.yourdomain.com emails might also be affected. Authenticate each subdomain individually.
Common Setup Errors and Wrong Assumptions
- Missing SPF include statement: Ensure include:spf.hubspotemail.net is in your SPF record. Merge multiple includes carefully. Only one SPF record is allowed per domain.
- Outdated DKIM selectors: HubSpot may regenerate DKIM keys over time. Re-authenticate in HubSpot and update DNS accordingly.
- DNS propagation delays: Changes can take up to 48 hours to propagate. Use “Recheck DNS” in HubSpot after waiting.
- Mixing test and production domains: Test domains don’t carry over to production. Authenticate each active sending domain individually.
Step-by-Step Setup Guide
- Confirm DNS access and HubSpot admin permissions.
- Navigate to Settings > Account Setup > Domains & URLs > Connect a domain.
- Choose Email Sending Domain and enter your sending subdomain (e.g., mail.yourdomain.com).
- HubSpot provides three CNAME records for DKIM and SPF configuration.
- Add the CNAMEs to your DNS and update SPF like:
v=spf1 include:spf.hubspotemail.net include:_spf.google.com ~all (merge existing entries if needed) - Wait for DNS propagation.
- Back in HubSpot, click Verify—you’ll see a green “Authenticated” badge when successful.
- Check for typos, ensure you’re editing the root DNS zone, and verify records using MXToolbox.
Measuring Results in HubSpot
Track authentication impact through:
- Delivered Rate: Emails reaching inboxes, not just sent.
- Open Rate: Proper authentication often lifts Gmail/Outlook opens.
- Bounce Rate: Should decrease as servers trust your domain.
- Spam Report Rate: Expect fewer complaints.
- Domain Reputation: Use Google Postmaster Tools for long-term trust signals.
HubSpot dashboards let you compare campaigns before and after authentication adjustments.
Example in Action
A mid-sized SaaS company notices that Gmail open rates for onboarding emails have dropped. Bounce reports reveal SPF failures because a new landing page subdomain wasn’t added. After updating SPF and verifying DKIM:
- Open rates recover
- Spam complaints drop by 50%
- Sales and marketing teams regain confidence in reporting
This demonstrates the importance of proper authentication for campaign reliability and accurate data.
How INSIDEA Helps
If email authentication issues are hurting campaigns, INSIDEA can help. We specialize in HubSpot email setup, automation, and deliverability to ensure emails land in inboxes and metrics reflect reality.
Our services include:
- Configuring new domains correctly from day one
- Cleaning up legacy DNS settings causing failures
- Aligning SPF, DKIM, and DMARC across marketing and sales emails
- Setting up deliverability dashboards for ongoing monitoring
You can hire our HubSpot experts to troubleshoot and maintain your authentication setup. Our HubSpot consulting services ensure your teams send confidently and scale campaigns without fear of deliverability issues.
Visit INSIDEA to schedule support and regain full control over your email performance.
Proper authentication in HubSpot ensures campaigns reach inboxes, reports reflect reality, and teams can confidently execute marketing at scale.
