Why your HubSpot emails are going to spam, and how to fix it

When HubSpot marketing emails go to spam, the most common cause is the sending domain. If the domain in your From address isn't connected to HubSpot with DKIM, SPF and DMARC, inbox providers can't confirm that HubSpot is allowed to send for you. HubSpot will even replace an unconnected From address with a HubSpot-managed one, such as user=yourcompany.com@hs-domain.com, and HubSpot itself says this can hurt how recipients engage with the email.

So start in your HubSpot settings under Content, then Domains & URLs, on the Email Sending tab. The domain you send from should show Authenticated. If it shows Partially authenticated or Not authenticated, fix the DNS records before you touch subject lines or content. If HubSpot lists some contacts as Not sent, see why contacts don't receive marketing email.

Why HubSpot emails land in spam

The sending domain isn't fully authenticated

Connecting a sending domain means adding DNS records that HubSpot generates for you: two CNAME records for DKIM, and one TXT record each for SPF and DMARC. Not authenticated means none of the methods are verified yet. Partially authenticated means DKIM works but SPF or DMARC doesn't. Click Continue setup to see the exact values HubSpot expects and compare them with your DNS. As of October 2026, connecting a sending domain needs a Starter, Professional or Enterprise subscription, according to HubSpot's sending domain article. Accounts on the free tools can't do it.

The SPF record wasn't merged

If your domain already has an SPF record for another email tool, HubSpot's setup asks you to add its include value to that record. Don't publish a new one next to it. The finished record should contain v=spf1 once and -all once. In HubSpot's example, its include sits just before -all.

DNS settings get in the way

HubSpot's articles flag two DNS settings. On Cloudflare, domain-wide CNAME flattening and proxying need to be off. A null MX record (MX 0 .) tells receiving servers the domain accepts no mail, and some providers reject mail from such domains, so HubSpot recommends removing it from the sending domain. Also give DNS time. Changes usually take 10 to 70 minutes and sometimes up to 48 hours.

DMARC is missing or doesn't allow HubSpot

HubSpot only marks a domain Authenticated once DMARC is verified too. Google's email sender guidelines require SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, and they accept a DMARC policy of p=none. Yahoo's sender best practices ask bulk senders for the same, with at least p=none. HubSpot says mail failing these checks bounces as a DMARC or Policy bounce. If your IT team runs a strict DMARC policy, it may need updating to include HubSpot. Quarantined email still shows as delivered in HubSpot, so this is easy to miss.

The From address uses a different domain

HubSpot recommends that your From address sits on the connected sending domain, and that a connected subdomain matches the domain in the From address. If you connected mail.example.com but the newsletter comes from hello@example.com, the two don't match. Check automated emails in workflows too.

People aren't opening

HubSpot calls mail that people opted in to but never open or click graymail, and says sending it lowers your sender score. Check the Health tab in the email tool for hard bounces, unsubscribes and spam reports over the last 30 days. It needs at least 400 emails sent in that period, and it has no Gmail spam reports, so use Google Postmaster Tools for Gmail. HubSpot treats a spam complaint rate of 0.1% or more on one email as a red flag, and Google asks senders to stay below 0.3%. HubSpot also lists purchased, rented and guessed addresses as sources to remove, and suggests fewer shortened links because they can raise spam reports.

How to fix it

1. Open the Email Sending tab, find the domain used in your From address and note its status.
2. Click Continue setup and copy each Host and Required data value into your DNS provider, or use the Sign in with your provider option if HubSpot offers it.
3. Merge HubSpot's SPF include into your existing SPF record.
4. If there's no DMARC record, add one. HubSpot gives v=DMARC1; p=none; as a neutral policy for senders new to DMARC. Add an rua address to get aggregate reports, and keep alignment relaxed (adkim=r, aspf=r) as HubSpot recommends.
5. Wait at least 20 minutes, then check the status again. If it still fails, look the records up with the MX Toolbox and dmarcian checkers HubSpot's article links to.
6. Change the From address on every marketing and automated email to an address on the authenticated domain.
7. Check the Health tab and Postmaster Tools, then send the next campaign to your most engaged contacts first, with Don't send to unengaged contacts left on.
8. If one company's filter keeps catching you, copy HubSpot's sending IPs from Email tools, then Manage allowlisting, and send them to that company's IT team with your sending domain.

How to stop it happening again

When someone adds a tool that sends from your domain, update the same SPF record and recheck the status in HubSpot. If you move to a new sending domain, HubSpot suggests telling subscribers first and building volume slowly. Look at the Health tab every month, keep graymail suppression on, and use double opt-in on forms if fake or mistyped addresses keep getting in. The bounces guide covers what to do with addresses that fail.

From client work

Mokwheel Factory Store sends its marketing email through SendGrid, with HubSpot on Starter, and the fix there also started in DNS. SendGrid link branding was failing because DNS records were missing. I fixed the records in Google Cloud DNS so tracked links use the store's own domain. Their list had 2,631 subscribers with no opens in a year. After I removed bots and role addresses, 2,385 real people were left, and I emailed them in eight daily batches of about 300, checking bounces, spam reports, opens and clicks before each batch went out. Read the Mokwheel case study.

If the domain still won't verify, or emails keep landing in spam after it does, book a free 30-minute call and we can go through your DNS records and sending data together.

Questions

Do I need DMARC if SPF and DKIM already pass?

HubSpot only shows a domain as Authenticated when DKIM, SPF and DMARC are all verified, and Google requires DMARC from senders of more than 5,000 messages a day to Gmail. A p=none policy meets Google's requirement.

Why does my From address show hs-domain.com?

The domain in your From address isn't connected as an email sending domain, so HubSpot rewrites it to a HubSpot-managed address and still sends. Connect the domain and set up DKIM to send under your own address.

Does this cover sales emails sent from my own inbox?

The sending domain you connect authorizes HubSpot to send marketing emails for you. One-to-one sales emails go out through your connected inbox, so check that mail provider's own SPF and DKIM setup for those.