Why Your HubSpot Emails Are Getting Blocked by DMARC

You sent a perfectly crafted email from your custom domain through HubSpot. It went out to 10,000 leads. Then you see the bounce rate spike. Your inbox placement tanked. You check your logs—DMARC is blocking it.

That’s not a fluke. It’s a misalignment. DMARC doesn’t care how well-written your message is. It only cares if the technical signals—SPF and DKIM—match the From address. If they don’t, your email fails before it even hits a mailbox.

Even with SPF and DKIM set up, many teams still get DMARC failures because of how HubSpot’s sending architecture works. Your domain might pass SPF, but DKIM alignment often breaks. The result? Blocks, bounces, and a damaged sender reputation.

DMARC isn’t just a filter. It’s a gatekeeper. And without the right alignment, you’re locked out—even if your content is flawless.

Key takeaways

  • DMARC fails when SPF or DKIM don’t align with the From domain, even if both are technically present.
  • HubSpot sends from its own infrastructure, which can break DKIM alignment unless the sender domain is properly published in the DKIM record.
  • Unaligned emails from your custom domain get blocked by receivers, leading to high bounce rates and inbox placement issues.

What Does 'DMARC Alignment' Mean for HubSpot?

DMARC alignment requires that both SPF and DKIM pass validation, and that the domains used in those records match the From domain in your email. If you send from [email protected], the SPF and DKIM records must be set to your domain, not hubspot.com. If they don’t align, your email fails DMARC, and most major inboxes will reject it.

Why HubSpot’s Infrastructure Complicates Alignment

You’re using HubSpot to send emails with your own domain, which means HubSpot’s systems handle the transport, but your domain must still pass DMARC checks. HubSpot doesn’t authenticate on your behalf—your domain has to stand on its own.

Let’s say your From address is [email protected]. For SPF to align, the sending IP must be authorized via your domain’s SPF record. If that record says "include:spf.hubspot.com" instead of including your own sending IPs, alignment fails. The same applies to DKIM: your domain must sign the email with a selector that matches your domain, not HubSpot’s.

What Happens When Alignment Fails

Without alignment, DMARC enforcement kicks in. Most large email providers (Gmail, Outlook, Apple Mail) treat unaligned messages as suspicious. Even if your domain is otherwise legitimate, misalignment leads to delivery failures or inbox placement in spam folders.

This isn’t just about technical formality—it’s a core part of email authentication. The IETF’s RFC 7489 (the DMARC standard) defines alignment as mandatory for trust. Without it, even properly formatted emails can be blocked.

Think of it like a driver’s license: you can have a car (your sending infrastructure) and a driver (HubSpot), but if the license is in a different name, the authorities won’t let you drive.

Verification tools like MailTester’s inbox placement test can help you check if alignment is working in real inboxes, not just in theory. It’s the only way to confirm your DMARC setup actually passes in practice.

How to Set Up DMARC Alignment for HubSpot: Step-by-Step

You can make HubSpot emails pass DMARC by ensuring your custom domain’s SPF and DKIM records are correctly configured in DNS, that the From domain in your campaigns matches the domain used in those records, and that all email sends come from a verified sender identity. DMARC only passes if both SPF and DKIM pass AND the domains align. Let’s walk through it.

  1. Log into your domain registrar’s DNS management panel. This is where you’ll edit your domain’s DNS records. Access it via your hosting provider, GoDaddy, Cloudflare, or similar. You’ll need to edit TXT and CNAME records here.
  2. Confirm your SPF record includes HubSpot. Your domain’s SPF record must list include:spf.hubspot.com. If it doesn’t, DMARC alignment fails. SPF records are limited to 10 include statements; if you have many third-party services, use a subdomain (e.g., mail.yourcompany.com) instead. For details on SPF record limits and best practices, see RFC 7208, Section 5.6.
  3. Add the DKIM CNAME record for HubSpot. In your DNS panel, add a CNAME record with the name spf._domainkey.yourcompany.com and the value spf.hubspot.com. This links your domain to HubSpot’s DKIM signing key. This step enables DKIM authentication, which DMARC checks.
  4. Match the From domain in HubSpot to your DNS records. In your HubSpot campaign settings, verify that the “From” email address uses the same domain as the one in your SPF and DKIM records (e.g., [email protected]). If you send from a different domain, DMARC alignment fails—even if SPF and DKIM pass individually.
  5. Test alignment and deliverability with MailTester’s real-time API. Before mass sending, use MailTester’s verification API to test addresses in your list. It checks for valid syntax, deliverability risks, and whether your domain alignment is working on a per-address basis. This catches issues silently in DMARC reports.

Pro Tip: Use a dedicated subdomain for sending

If you have multiple senders or complex policies, consider using a subdomain like emails.yourcompany.com. This isolates your sending domain from your main website and reduces the risk of misalignment due to conflicting SPF/DMARC rules. It’s a common practice for higher-volume senders.

Verify your setup with real-world testing

Avoid relying only on DNS checks. Use tools like Mail-Tester.com to send a test campaign and see how it scores on deliverability and alignment. This helps identify gaps in SPF/DKIM configuration or DMARC policy issues that aren’t visible in DNS alone.

After setup, monitor DMARC reports via a service like DMARC Analyzer to detect failures or unexpected senders. Even with correct DNS, poor sender reputation or spam traps can cause inbox placement issues.

The Role of SPF, DKIM, and DMARC in HubSpot Email Delivery

You need SPF, DKIM, and DMARC set up correctly to ensure HubSpot emails sent from a custom domain pass authentication checks. Without them, even valid emails may be rejected. SPF authorizes HubSpot’s servers to send on your behalf. DKIM cryptographically signs each email, proving it wasn’t altered. DMARC tells receivers what to do when SPF or DKIM fails—deliver, quarantine, or reject. Without alignment, emails fail even if technically valid.

How Each Protocol Works With HubSpot

  • SPF specifies which servers can send email for your domain. For HubSpot, this includes their email delivery IPs. You must add include:hubspot.net to your SPF record.
  • DKIM signs outgoing emails using a private key hosted by HubSpot and a public key published in DNS via a CNAME record. This ensures message integrity and sender authenticity.
  • DMARC policies evaluate both SPF and DKIM results. If alignment fails—meaning the "from" domain doesn’t match the SPF or DKIM signer—receiving servers may reject the email.
  • DMARC alignment is required. Even with valid SPF and DKIM, a mismatch between the "From" header and the domain in the authentication records triggers rejection.
  • Receiving mail servers use DMARC policies published in DNS to decide how to act. If your DMARC record says rua=mailto:[email protected], you’ll get reports on failures.

Why Alignment Matters

Let’s be clear: DMARC doesn’t care if you’ve authenticated your email—it cares if the authentication aligns with the sender’s domain. If your HubSpot emails show from: [email protected] but DKIM is signed by hubspot.net and no alignment is defined, your email fails. This is why you must use domain-mode authentication in HubSpot and ensure your DNS records support it.

According to the DMARC specification (RFC 7483), alignment is defined by either simple or relaxed rules. Most domains use relaxed for better compatibility. But without proper configuration, even one misaligned email can trigger receiver scrutiny.

For teams using HubSpot, misconfigured DMARC is a major cause of inbox placement drops and bounces. You can test whether your domain is fully aligned using a verified email-sending tool. MailTester’s inbox placement tool simulates real inboxes and shows if your email hits spam or is rejected due to DMARC issues.

Before sending to large lists, verify your domain’s authentication setup with a real email verification API. MailTester’s API can help identify domains at risk of rejection based on DMARC policy and alignment. It’s a fast way to catch issues before they cost you deliverability.

HubSpot DKIM CNAME Records: What You Need to Add

You need to add a DKIM CNAME record to your domain’s DNS zone with a selector (like selector1.yourcompany.com) pointing to a unique public key hosted by HubSpot. This key is generated by HubSpot and must be copied exactly as provided. If missing or misconfigured, emails fail DKIM checks and may be rejected under DMARC policies.

Understanding the DKIM Record Structure

Each DKIM record starts with a selector, a label HubSpot assigns to differentiate between multiple keys (e.g., selector1.yourcompany.com). This selector is specific to your HubSpot account and your custom domain. The CNAME value is a string pointing to a HubSpot-managed domain, such as selector1.yourcompany.hubspotmail.com.

The public key is never sent directly to you. Instead, HubSpot serves it via DNS, which allows receiving mail servers to verify the authenticity of your emails using asymmetric cryptography. This process is standard across all major email providers and is defined in RFC 6376.

Adding and Verifying the Record

Once you have the correct selector and CNAME value from HubSpot, you’ll add the record to your domain’s DNS zone file through your registrar or DNS provider (like Cloudflare, AWS Route 53, or GoDaddy). You must enter the full name (e.g., selector1.yourcompany.com) and the full value (e.g., selector1.yourcompany.hubspotmail.com).

After adding the record, verify it in HubSpot. Go to your domain settings and click “Verify DKIM.” HubSpot will query DNS to confirm the record exists and resolves correctly. If it doesn’t, check for typos, propagation delays (typically up to 24 hours), or incorrect record type (must be CNAME, not TXT).

A failed DKIM check results in DMARC rejection, even if SPF passes. This means your emails end up in spam folders or are blocked entirely. Use inbox placement testing to simulate real delivery conditions and verify your full setup before sending to your entire list.

Common Pitfalls to Avoid

Don’t reuse old records or guess selectors. Every custom domain needs a unique DKIM configuration. Also, avoid mixing DKIM records from different providers within the same domain. Multiple conflicting records cause validation failure.

Once verified, the record stays valid until you change your sending domain configuration in HubSpot. If you later add a second sending domain, you’ll need a new DKIM selector and CNAME.

For bulk email list validation before sending, ensure your list is clean to avoid reputation issues. Run it through MailTester’s bulk verification to identify invalid, catch-all, or risky addresses early.

How to Verify Your DMARC Alignment Without Sending Emails

You can test your custom sending domain’s DMARC alignment in real-world conditions without sending a single email. Using MailTester’s inbox-placement tester, enter your From address and sending domain to check SPF, DKIM, and DMARC configuration instantly. The tool returns exact failure reasons—like misaligned headers or missing DNS records—so you can fix issues before your campaigns go live. This avoids bounces, inbox placement drops, and reputation damage. Test all addresses in your list before sending at scale.

Start with Real-World Testing

Don’t rely on DNS record checkers alone. They verify existence, not alignment. DMARC alignment requires that the domain in the From header matches the domain used in SPF or DKIM. This is how email receivers validate sender authenticity.

  1. Go to MailTester’s inbox placement test — https://mailtester.com/inbox-tester. You’re not sending to real users. You’re simulating the entire delivery path, including DMARC checks.
  2. Enter your From address and sending domain. For example, if your campaign sends from [email protected], use that exact address and domain. This is the sender identity receivers evaluate.
  3. Run the test and review the results. The system checks for SPF alignment, DKIM signature validity, and DMARC policy enforcement. If any fail, it gives you a clear, actionable reason—e.g., “DKIM selector mismatch,” “SPF domain alignment failure,” or “DMARC policy not enforced.”
  4. Fix the root issue. For example, if DKIM fails, verify the public key and selector are published correctly. If SPF aligns but DMARC fails, check whether your policy is set to reject or quarantine, and confirm the alignment scope.
  5. Test every unique From address. If you send from multiple domains or subdomains (like [email protected]), test each one. Alignment can break due to subdomain differences.

Prevent Failures Before Sending

Even with correct DNS records, alignment failures happen if you’re not using the right domains in your email setup. For example, if your sender domain is [email protected] but you use [email protected] in the From field, DMARC fails unless both are aligned under the same policy.

Using MailTester’s inbox placement tool, you can catch these issues before you hit Send. It mimics how real email providers evaluate your message today, including DMARC. This method is faster and safer than testing with live emails, which can trigger spam filters or damage sender reputation.

For larger workflows, integrate this test into your pre-send pipeline using the MailTester API or verify entire lists with bulk verification.

DMARC is not optional—it’s a core part of modern email authentication. According to RFC 7672, alignment is required for valid DMARC evaluation. But alignment checks are complex. Let MailTester’s real-time inbox tester do the work so you don’t have to.

Common Mistakes That Break DMARC Alignment with HubSpot

You’re sending emails through HubSpot using a custom domain, but DMARC is failing because your SPF, DKIM, or alignment is misconfigured. Common culprits include mismatched domains in campaign settings, incomplete SPF records that omit HubSpot’s IPs, stale DKIM records, or forgotten DNS changes after a domain switch. These mistakes break email alignment and result in bounces or inbox filtering. Let’s go through the most frequent ones.

Domain Mismatch in Campaign Settings

  • Using [email protected] in HubSpot emails but pointing SPF/DKIM records to yourcompany.com is a mismatch. DMARC only passes if the From domain in the email (your sending domain) aligns with the domain used in SPF and DKIM DNS records.
  • Ensure the domain in your HubSpot email template settings exactly matches the domain you’ve configured in DNS. Even a minor typo or subdomain difference breaks alignment.

Incomplete or Misconfigured SPF & DKIM

  • SPF must include include:sendgrid.net (if using SendGrid) or include:hubspot.net — but only for authorized senders. If you hardcode specific IP addresses and leave HubSpot out, your emails fail SPF checks.
  • If you’ve updated your DKIM setup, keep only the most recent CNAME record. Old or conflicting DKIM records from previous providers (like Mailchimp or Constant Contact) can cause DKIM validation to fail. Use MXToolbox to verify current DKIM alignment.
  • DKIM CNAME records don’t last forever. If you change email providers or domains, old records may expire or become stale. Never assume one CNAME is forever — check DNS periodically.

DMARC Enforcement and Misalignment

  • DMARC reports (found at dmarcanalyzer.com) will show you exactly which emails fail due to lack of alignment or authentication. Pay attention to the reason field: “spf” or “dkim”.
  • Forgetting to remove old DMARC policies (like rua=mailto:[email protected]) can result in reports being sent to outdated addresses, masking real issues.
  • Testing alignment isn’t just for setup — it’s ongoing. Every time you switch providers, send from a new email tool, or change domains, revalidate alignment.

Use tools like inbox placement testing to simulate real-world delivery, including DMARC checks. If your email fails alignment, your sender reputation and deliverability suffer — even if the email reaches the inbox. Fix it early, or risk being flagged as spam.

Why MailTester’s Real-Time Verification API Helps Prevent Alignment Failures

You can prevent DMARC failures by catching invalid, catch-all, or role-based email addresses before sending. MailTester’s real-time API checks each address for validity, domain reputation, and known issues like spam traps or disposable domains — all of which can trigger DMARC rejections. This reduces bounces and protects your sender reputation.

Spotting the Hidden Causes of DMARC Bounces

When you send through HubSpot with a custom domain, DMARC doesn’t just check your domain’s authenticity — it verifies that the sender (P) matches the domain in the From field (F). If the email address is invalid, the sending server may default to a generic or impersonated sender, breaking alignment. For example, a catch-all address or a role account like [email protected] can cause the receiving server to reject the message based on reputation or alignment rules.

MailTester’s API identifies these risks upfront. It checks if an address is truly deliverable — not just syntactically correct — and flags catch-alls or role accounts before they get sent. According to the DMARC specification (RFC 7208), alignment failure occurs when the authentication results don’t match the From domain, making early validation essential.

High Accuracy, Clear Verdicts, Real-Time Protection

With 98.9% accuracy, MailTester’s API delivers clear verdicts: valid, invalid, risky, or catch-all. You’re not guessing — you know exactly what’s safe to send. It also checks the domain’s reputation, pulling from known blocklists and spam trap databases that are publicly accessible via resources like Spamhaus.

Let’s say you’re sending to 10,000 leads. A single invalid or role-based address can degrade your sender reputation, increase bounce rates, and eventually get your domain flagged. By filtering these out in real time, you avoid the downstream impact on DMARC compliance and inbox placement.

Use this API before every send — whether in HubSpot, SendGrid, or your own system. It’s built to integrate directly into workflows, and you can test inbox placement too with our inbox placement tester. The cost? Start with 100 free verifications, and credits never expire — making it a low-risk, high-impact step.

How to Fix DMARC Failures Detected by MailTester

If MailTester flags a HubSpot email as failing DMARC, start by removing any address marked as invalid or catch-all. For domains failing DMARC, audit SPF and DKIM records for misalignment—common causes include incorrect hostnames, expired selectors, or missing records. Run inbox-placement testing via MailTester’s inbox tester to validate alignment with real inboxes. Correct DNS records, then retest until the domain passes.

Step-by-Step Fix: From Detection to Confirmation

  1. Identify failing addresses in your list using MailTester’s bulk verification. If an address returns "invalid" or "catch-all," remove it. Validating sends ensures you’re not wasting resources on addresses that won’t receive your email.
  2. Check domain-level SPF and DKIM against your HubSpot setup. DMARC relies on both SPF and DKIM alignment. Misalignment happens when the sending domain doesn’t match the domain used to authorize the email. Use tools like MXToolbox or SPF Check to validate your records in real time.
  3. Validate with inbox placement testing. Even if DNS records appear correct, DMARC can still fail in practice. MailTester’s inbox tester simulates real-world delivery across Gmail, Outlook, and other providers. This reveals whether alignment is working as intended, not just in theory.
  4. Update DNS records if discrepancies are found. Common fixes include adding missing SPF records, ensuring DKIM selectors are correct, or adjusting SPF mechanisms (e.g., using include:spf.hubspot.com correctly). DNS changes can take up to 48 hours to propagate.
  5. Re-run verification after DNS updates. Use MailTester’s bulk verification or API to retest. Continue until the domain consistently passes DMARC checks across all test inboxes.

Why This Process Matters

DMARC failures don’t just block delivery—they damage sender reputation over time. A single failed check can raise red flags with inbox providers, even if you fix it later. The RFC 7052 specification outlines how DMARC policies are enforced, and misaligned signals are treated as potential spoofing attempts. This is why alignment verification isn’t optional—it’s a baseline requirement for trusted delivery.

Let’s be clear: no tool can bypass broken DNS. If your SPF record is missing, no amount of email testing will fix it. The only way to ensure consistent inbox placement is to fix the root cause—the DNS configuration—and confirm it works through a live inbox test.

Final Checks Before Sending Emails from HubSpot

You must verify your return-path matches your sending domain, confirm SPF and DKIM are published and active in DNS, test your email list with a tool like MailTester to catch invalid or risky addresses before sending, and monitor HubSpot’s delivery reports—pause or adjust if your bounce rate exceeds 0.5%. These steps reduce the risk of messages being blocked, rejected, or marked as spam.

Confirm Your DNS Settings Are Correct

  • Ensure your sending domain (e.g., yourcompany.com) is set as the return-path in HubSpot. This domain must also handle bounces.
  • Verify your SPF record includes include:_spf.yourcompany.com and include:spf.hubspot.com — HubSpot's mail servers must be explicitly authorized.
  • Check that your DKIM selector (e.g., hs or hubspot) is published in DNS and properly configured on your sending domain.
  • Use a tool like MXToolbox to inspect real-time DNS records and confirm they’re active and correctly formatted.

Test Deliverability Before Going Live

  • Run a sample of your list through MailTester’s bulk verification to flag invalid, disposable, or catch-all emails before sending.
  • Use the inbox placement test to check how your message performs across major inboxes (Gmail, Outlook, Apple) before launching a campaign.
  • Monitor HubSpot’s built-in delivery reports immediately after sending. If bounce rates exceed 0.5%—a common threshold for suspect behavior—pause and review your list.
  • High bounce rates, especially from spam traps or invalid domains, hurt sender reputation over time. Address the root cause, not just the symptom.
Even a single hard bounce from a non-existent address can trigger rate-limiting or temporary blocking from some providers. Prevention is far more effective than recovery.

Let’s be clear: DMARC alignment isn’t just about technical compliance—it’s about trust. An email that passes SPF and DKIM but fails DMARC alignment will be rejected by strict inboxes. You can’t skip this.

For ongoing maintenance, use MailTester’s verification API to automate list hygiene in your workflows. Unlike manual checks, continuous validation helps maintain sender reputation and reduces the risk of delivery disruptions.

Once you’ve verified your domain, tested your list, and confirmed your DNS records are active, you’re ready to send. But don’t stop there—monitor performance, clean your list regularly, and maintain good sending habits for long-term inbox placement.

Conclusion: Deliverability Starts with Technical Alignment

DMARC alignment is not optional. It is a non-negotiable requirement for inbox placement, especially when using HubSpot with a custom sending domain.

Misalignment in SPF, DKIM, or domain headers is a leading cause of email filtering and delivery failure. Fixing it before sending is far more effective than troubleshooting bounces after the fact.

Use MailTester to validate your domain configuration and email addresses early. This catches misalignment and invalid addresses before they hurt deliverability and inflate bounce rates.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does HubSpot automatically set up DMARC for my domain?

No. HubSpot handles SPF and DKIM setup, but you must ensure domain alignment and publish correct DNS records.

Can I use multiple domains in HubSpot with different DMARC settings?

Yes, but each domain must have its own SPF and DKIM configuration aligned to the From domain.

What happens if my DKIM record is incorrect in HubSpot?

Emails sent from that domain fail DKIM validation, triggering DMARC rejection by receiving servers.

How do I know if my domain passes DMARC?

Use MailTester’s inbox-placement test or a public tool like MXToolbox to check your domain’s DMARC policy and results.

Are role accounts like admin@ or sales@ safe to send to?

Not reliably. They often trigger spam filters or return bounces. Use MailTester to filter them out.

What is a catch-all email address, and why does it hurt deliverability?

A catch-all accepts any email address on a domain. It’s often used by spammers and triggers deliverability issues.

Does a DMARC policy of 'none' still block emails?

No. A 'none' policy only reports failures. It doesn't block emails but offers no protection.

Can I test DMARC alignment without sending real emails?

Yes. MailTester’s inbox-placement testing simulates real delivery without sending live messages.

Do expired DNS records affect DMARC?

Yes. Expired or missing SPF, DKIM, or DMARC records cause alignment failures and delivery blocks.

Why does my email show as 'pass' on MailTester but still fail in the inbox?

Some providers still enforce stricter rules. Use MailTester to clean your list and reduce risk, but monitor delivery in real inboxes.

How many free verifications does MailTester offer?

100 free verifications to start, with purchased credits that never expire.

Does MailTester integrate with HubSpot?

Yes. MailTester integrates with HubSpot, allowing you to verify contacts before syncing to campaigns.