How can I improve SPF alignment and email deliverability when using Hubspot?
Published 22 Jul 2025
Updated 21 Oct 2026
13 min read
Summarize with
Updated on 21 Oct 2026: We clarified HubSpot's custom return-path beta and added checks for SPF alignment in delivered messages.
Authenticate your HubSpot email sending domain, publish HubSpot's account-specific SPF include in the single SPF TXT record at the hostname HubSpot provides, and make aligned DKIM the main DMARC pass path. Adding the include to your visible From domain does not change the return-path used for SPF checks. For SPF alignment itself, eligible Marketing Hub Enterprise accounts can configure a custom return-path under their own domain through HubSpot's beta.
HubSpot deliverability has two linked jobs: authentication and recipient trust. Authentication proves the mail is allowed to use your domain. Recipient trust comes from sending mail people asked for, keeping bounce and complaint rates low, and separating mail streams when their purposes differ. A stricter DMARC policy can protect your domain, but it does not improve inbox placement by itself.
- Immediate fix: Use HubSpot's domain authentication flow, publish DKIM, merge the supplied SPF include into the correct record, and verify DMARC reporting.
- Main caveat: SPF authorization and SPF alignment are different. Aligned DKIM is usually the dependable DMARC pass path for HubSpot mail.
- Direct alignment option: Configure a custom return-path if your HubSpot subscription supports it and SPF alignment is required.
- Deliverability rule: Do not move to quarantine because you expect it to improve delivery. Move when legitimate mail is already passing DMARC.
What HubSpot SPF alignment means
SPF has two separate ideas that get mixed up. First, the sending IP must be allowed by the SPF record for the envelope return-path domain (the SMTP MAIL FROM domain). Second, for DMARC, that SPF-authenticated domain must share the visible From address's organizational domain under relaxed alignment, or match its domain exactly under strict alignment. The first part is SPF authentication. The second part is SPF alignment.
HubSpot's current domain connection guidance lists MX, DKIM, SPF, and DMARC records. Its setup flow supplies two DKIM CNAME records plus account-specific DNS values. If an SPF record already exists at the requested host, add HubSpot to that record rather than creating a second SPF record. The official HubSpot authentication article is the place to copy the account-specific values.
SPF passes
The receiving server checked the return-path domain's SPF record and found that the sending IP was authorized.
- Checked domain: The envelope sender domain, not always the visible From domain.
- Common result: SPF pass can appear in reports even when DMARC does not count SPF as aligned.
SPF alignment
DMARC checked whether the SPF-authenticated domain matches the visible From domain under the configured relaxed or strict alignment mode.
- Checked identity: The visible From domain compared with the return-path domain.
- Common result: If the return-path remains under HubSpot's domain, SPF can pass without satisfying DMARC alignment.
The report wording matters
A DMARC aggregate report can show SPF authentication passing under auth_results while SPF alignment fails under policy_evaluated. DMARC still passes if DKIM passes with an aligned domain. RFC 9990 defines these separate results; DMARC needs only one aligned authentication mechanism to pass.
How to configure HubSpot authentication
HubSpot email sending domain setup with DKIM CNAME records and SPF and DMARC verification.
Start inside HubSpot because its DNS values are account-specific. Then edit DNS at your provider. HubSpot's current connection guidance lists MX, DKIM, SPF, and DMARC records, so copy every record shown for your account rather than relying on a generic example. After that, check message headers and DMARC aggregate reports because the DNS status screen proves record discovery, not real-message alignment.
You need HubSpot Domain settings permissions and DNS access. HubSpot requires an email sending domain that is not used to host website content, so choose a dedicated marketing subdomain when needed. With Cloudflare, disable proxying for the email DNS records and domain-wide CNAME flattening, as specified in HubSpot's setup requirements.
- Connect the domain: In Settings > Content > Domains & URLs > Email Sending, choose Connect sending domain and enter the exact domain or subdomain used in your marketing From address.
- Publish DKIM: Add the two DKIM CNAME records HubSpot gives you. Aligned DKIM is the normal DMARC pass path on the default shared sending setup.
- Review the other records: Use the hostnames HubSpot supplies for SPF and DMARC, and review any MX instructions without replacing working employee-mail MX records. Preserve an existing DMARC policy and reporting destinations. A marketing subdomain can inherit DMARC policy when it has no record of its own.
- Merge SPF safely: If SPF already exists at that host, insert HubSpot's include before the final all mechanism. Keep one v=spf1 and one final all mechanism, preserving the existing qualifier unless you have reviewed a policy change. Do not create a second SPF record.
- Keep Google: Keep Google's SPF include at the hostname Google Workspace uses for employee mail, and configure Google Workspace DKIM too. SPF is not inherited by subdomains, so do not copy the root record to every marketing subdomain.
- Verify results: Wait at least 20 minutes before rechecking HubSpot. DNS verification can take up to 48 hours. Then send real mail, inspect headers, and compare the results with DMARC reports.
Illustrative SPF TXT record for a host used by both sendersdns
v=spf1 include:_spf.google.com include:123456.spf03.hubspotemail.net -all
Replace include:123456.spf03.hubspotemail.net with the value in your own HubSpot account. This example applies only when both senders need authorization at the same hostname; -all is an example policy, not a requirement to change an existing ~all policy.
If that SPF record starts growing because you use several senders, Suped's Hosted SPF manages authorized senders in one place without requiring a manual DNS edit for each change. That is useful when separate teams add sending systems over time.
How to configure a custom return-path for SPF alignment
HubSpot offers a custom return-path beta for Marketing Hub Enterprise. This is the direct control for SPF alignment. Instead of using HubSpot's default return-path, the message uses a bounce subdomain under your domain. With relaxed SPF alignment, that subdomain and the visible From domain satisfy alignment when they share the same organizational domain. Each dedicated IP address supports only one custom return-path.
- Connect first: Complete the normal email sending domain connection before adding a return-path.
- Open the action: Go to Content, Domains & URLs, then Email Sending. Open Actions beside the sending domain and choose Add return-path domain.
- Choose an unused subdomain: The return-path subdomain cannot already have MX or CNAME records for another email provider.
- Publish and verify: Add the DNS records HubSpot supplies and click Verify. HubSpot keeps using its default return-path until verification completes, which can take up to 48 hours.
Check the SPF alignment mode
Relaxed alignment, aspf=r or the default when aspf is absent, compares organizational domains. Strict alignment, aspf=s, requires the return-path domain to match the visible From domain exactly. HubSpot supports a custom return-path with strict alignment only when the email sending domain itself uses a subdomain. Keep DKIM configured even when SPF is aligned so DMARC has a second pass path.
How to verify SPF alignment in message headers
After DNS verification, send a normal HubSpot marketing email to an inbox you control and open the full message headers. Read the Authentication-Results added by the receiving mail service. A green DNS status in HubSpot does not establish which domains were authenticated on a delivered message.
Illustrative headers: DMARC passes through DKIMtext
From: Example team <news@mail.example.com> Return-Path: <bounce@provider.example.net> Authentication-Results: mx.example.org; spf=pass smtp.mailfrom=provider.example.net; dkim=pass header.d=mail.example.com; dmarc=pass header.from=mail.example.com
These are illustrative domains, not HubSpot DNS values. SPF passes for provider.example.net, which does not share an organizational domain with mail.example.com. DKIM passes with an exact domain match, so DMARC passes without SPF alignment.
- Compare smtp.mailfrom with header.from using the aspf mode in your DMARC policy. SPF pass alone does not prove the domains match.
- If the custom return-path is missing, check its HubSpot verification status and send a fresh message after verification finishes.
- If DKIM fails or uses an unrelated header.d domain, check the connected sending domain and its DKIM CNAME records before increasing DMARC enforcement.
- Repeat with a direct delivery if the message was forwarded. Forwarding commonly breaks SPF; DKIM can still pass when signed content is preserved.
SPF includes and the 10 DNS lookup limit
Having several SPF include mechanisms is not a problem by itself. Publish only one SPF TXT record per host and keep valid syntax. The 10 DNS lookup limit counts evaluated lookup-causing terms, including nested includes, a, mx, ptr, exists, and redirect, rather than simply counting visible includes or every DNS packet. Exceeding that limit produces SPF permerror, as defined in RFC 7208.
|
|
|
|---|---|---|
Record count | One v=spf1 record | Multiple v=spf1 records at one host |
Lookup-causing terms | 10 or fewer | More than 10 |
HubSpot include | Account value | Wrong include |
Google mail | Authorized at its sending hostname | Removing required Workspace authorization |
Compact SPF checks for HubSpot domains
Use Suped's SPF checker after every DNS edit. Check for duplicate records, total DNS lookups, invalid mechanisms, and the final qualifier. If the record is near the lookup limit, SPF flattening or hosted SPF management can reduce lookup pressure. Remove obsolete senders first, and keep flattened IP data refreshed as providers change their sending infrastructure.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Do not remove Google by accident
If your normal outgoing mail uses Google Workspace, removing Google's SPF include can break SPF for regular employee mail. HubSpot authentication fixes HubSpot-sent marketing mail. It does not replace Google Workspace authentication.
What improves HubSpot deliverability
Authentication is the entry requirement. Deliverability improves when mailbox providers see wanted mail, stable identity, low complaint rates, and clean recipient data. HubSpot recommends connecting an email sending domain, using familiar From names, cleaning subscriber lists, monitoring engagement, and warming a changed sending domain gradually. The HubSpot overview also says an unconnected domain in the From address is changed to a HubSpot-managed domain, which is a direct reason to authenticate before sending.
Delivery means the recipient server accepted a message; inbox placement means it reached the inbox rather than spam. Track complaints and hard bounces alongside clicks and conversions. Open rates alone do not establish inbox placement.
For senders reaching 5,000 or more messages per day to personal Gmail accounts, SPF and DKIM plus DMARC are required. A DMARC policy of p=none meets the minimum, provided at least one authentication method is aligned. Marketing and subscription messages also need one-click unsubscribe headers and a visible unsubscribe link in the body. These requirements are already in effect; check Google's sender guidelines when reviewing a HubSpot send.
- Separate streams: Use clear subdomains for marketing mail, sales outreach, transactional mail, and employee mail when volumes justify it.
- Protect DKIM: Make sure HubSpot and Google Workspace both sign with domains that match the visible sender identity under the configured DKIM alignment mode.
- Clean contacts: Suppress hard bounces, unsubscribes, spam complainers, and contacts without permission. Review inactivity before suppressing unengaged contacts; a role address alone does not prove poor recipient quality.
- Avoid fake warmup: Do not use artificial replies or clicks to manipulate reputation signals. Increase volume gradually with recipients who recently engaged.
- Watch reputation: Monitor domain and IP listings on blocklists (blacklists), especially after new campaigns or vendor changes.
- Use graymail suppression: HubSpot's Don't send to unengaged contacts setting excludes inactive contacts. Review audience exclusions before sending rather than disabling them to increase reach.
Internal delivery can differ
If HubSpot mail passes externally but fails inside your company, inspect the copy processed by the internal security gateway. Compare its Authentication-Results and DKIM signature with an external copy, then check whether the gateway rewrote signed content or applied a rule to HubSpot's shared return-path. Use a narrow rule based on verified sending patterns instead of broad wildcard allowlisting.
For a broad read on the domain, use a domain health check after HubSpot, Google Workspace, and DMARC are configured. That catches related authentication and DNS issues together instead of treating one report field as the whole problem.
When to move DMARC to quarantine
Move to quarantine when legitimate mail is already passing DMARC consistently. Review reports across a representative sending cycle, identify every important source, and investigate remaining failures. There is no universal safe pass-rate percentage: a high overall rate can hide a failing low-volume sender. Keep p=none while that work is incomplete. RFC 9989 removed the pct sampling tag, so do not rely on pct=25 to stage enforcement.
DMARC rollout checkpoints
Practical checkpoints before raising enforcement for a domain that sends through HubSpot.
Monitoring
p=none
Use while legitimate sources are still being identified.
Standards test mode
p=quarantine; t=y
Requests one-level-lower handling; older receivers can ignore t=y.
Full quarantine
p=quarantine
Use after residual failures are understood.
Reject
p=reject
Use after important legitimate sources have verified DMARC pass paths and residual failures are understood.
DMARC test-mode record exampledns
v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com
Test mode is not percentage enforcement
Under RFC 9989, t=y asks a receiver to apply handling one policy level below the published policy while reports continue. It does not sample a percentage of failures. Older receivers that do not recognize t can ignore it, so remain at p=none until full quarantine is operationally safe.
Quarantine is not an inbox placement lever
A stricter DMARC policy tells receivers what to do with mail that fails DMARC. It does not make wanted mail more wanted, and it does not repair poor list quality, weak engagement, or a damaged sender reputation.
Monitor HubSpot authentication in Suped
Suped's DMARC reporting product helps keep HubSpot, Google Workspace, and other legitimate senders visible while you prepare for enforcement. Use it to review authentication failures by sending source and decide which DNS or platform setting needs attention.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
A useful workflow is concrete: identify HubSpot traffic, confirm whether DKIM passes with the right domain, distinguish SPF authentication failure from SPF alignment failure, then turn each issue into a DNS or platform action. Suped's automated issue detection and steps to fix reduce the report-reading work to a list of actions.
- Source mapping: Confirm which traffic is HubSpot, Google Workspace, or another sender before changing policy.
- Hosted controls: Manage SPF and DMARC changes without repeated manual DNS edits across many domains.
- Alerts: Catch sudden authentication failures or reputation problems before a campaign exposes them at scale.
- Post-change checks: Compare HubSpot results before and after a DNS or return-path change to confirm that legitimate traffic still passes DMARC.
Views from the trenches
Best practices
Treat DKIM alignment as the main HubSpot control, then use SPF to authorize allowed senders.
Keep one SPF TXT record per host and check lookup counts after every sender is added.
Stage DMARC enforcement only after legitimate HubSpot and Workspace traffic passes.
Use real engagement and consent quality instead of artificial reply or click activity.
Common pitfalls
Reading SPF pass as DMARC pass hides the return-path domain mismatch in reports.
Adding a second SPF TXT record breaks validation even when both records look correct.
Moving to quarantine to boost delivery creates risk without fixing reputation problems.
Removing Workspace SPF while fixing HubSpot authentication breaks employee mail.
Expert tips
Separate marketing and employee mail streams when volumes and risk justify subdomains.
Forwarding commonly breaks SPF; DKIM survives only when signed content stays unchanged.
Use dedicated IPs only when volume and operational ownership support that decision.
Monitor blocklist and blacklist signals alongside authentication, not as a separate task.
Marketer view
Marketer from Email Geeks says SPF can pass for HubSpot while DMARC still reports SPF as not aligned because the return-path domain is different.
2024-04-09 - Email Geeks
Marketer view
Marketer from Email Geeks says adding HubSpot to the root SPF record is useful only when that domain is the one being evaluated for SPF.
2024-04-09 - Email Geeks
HubSpot marketing email versus employee email
For non-marketing mail, check the actual sender. If employees send through Google Workspace, HubSpot's SPF include does not improve those messages. Google Workspace needs its own SPF, DKIM, and correct From domain handling. For HubSpot marketing mail, HubSpot's DNS records and DKIM signing are the relevant controls.
Frequently asked questions
Because SPF was evaluated against the envelope return-path domain, while DMARC compares that domain with the visible From domain. SPF can pass authentication and still fail SPF alignment.
Add the account-specific include when HubSpot asks for it at that hostname, before the existing final all mechanism. Keep Google Workspace's authorization where it sends employee mail. This DNS change does not change HubSpot's return-path, and SPF is not inherited by subdomains.
Yes. Eligible Marketing Hub Enterprise accounts can use the custom return-path beta. Relaxed alignment requires the return-path and From domains to share an organizational domain. Strict alignment requires an exact domain match and a subdomain-based sending setup. Verify a delivered message after configuration.
No. Quarantine tells receivers how to handle mail that fails DMARC. It protects your domain, but inbox placement still depends on authentication, reputation, engagement, and recipient quality.
Count DNS lookups, not only visible includes. SPF permits no more than 10 lookup-causing terms during evaluation, including nested includes. Exceeding the limit produces permerror.
Use a dedicated IP only when you have enough consistent volume and operational control to own its reputation. Low or uneven volume is often better handled on shared infrastructure with strong domain reputation.
