Fixing HubSpot Deliverability Warnings Through Proper DNS Authentication

Email deliverability warnings inside your marketing platform usually stem from misconfigured or missing domain authentication records in your DNS zone file. When these records are incorrect, mailbox providers like Google and Microsoft will flag or block your automated sends, drastically hurting your campaign performance.

To diagnose and resolve these issues quickly, you should run your sending domain through the Email Security Checker on XiaTools to instantly identify missing or misconfigured DNS records. Proper DNS setup proves to inbox providers that your sending domain authorizes HubSpot to dispatch emails on your behalf.

Understanding HubSpot Email Authentication

When you send marketing emails through HubSpot, the platform needs permission to use your brand's domain name in the sender address. Without proper authentication, your emails will display frustrating "via hubspotemail.net" or "on behalf of" warnings in modern email clients, which immediately erodes subscriber trust and tanks open rates.

The Core DNS Trio: SPF, DKIM, and DMARC

To achieve complete email alignment and clear all deliverability warnings, you must configure three distinct types of DNS records:

• SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of your domain.
• DKIM (DomainKeys Identified Mail): Adds a cryptographic digital signature to your outbound messages, proving the email was not altered in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving mail servers what to do if SPF or DKIM checks fail.

Step-by-Step Guide to Fixing Deliverability Warnings

Resolving your HubSpot deliverability warnings requires gathering the exact record values from your marketing platform and publishing them into your DNS host's management panel. Depending on your DNS provider, menu paths may differ slightly, but the core settings remain identical.

Step 1: Set Up SPF Authentication

HubSpot utilizes a mechanism called inclusion for SPF. If you already have an SPF record for example.com, you must not create a second TXT record, as a domain can only have one active SPF record.

Log in to your DNS provider, locate your domain's DNS management settings, and update your existing SPF TXT record to include HubSpot's server:

v=spf1 include:spf.protection.outlook.com include_a:example.com include:hubspotemail.net ~all

If you do not have an existing SPF record, create a new TXT record with a name of @ (or leave it blank for your root domain) and use this value:

v=spf1 include:hubspotemail.net ~all

Step 2: Configure DKIM (CNAME Records)

HubSpot uses custom DKIM signing keys, which are implemented via CNAME records rather than standard TXT records. This allows HubSpot to automatically manage and rotate your signing keys securely.

Navigate to your HubSpot settings to find your custom DKIM records, which typically look like this:

Add these two CNAME records inside your DNS hosting provider's control panel. Ensure that you omit your root domain from the host field if your DNS provider automatically appends your domain name.

Step 3: Implement a DMARC Policy

DMARC ties your SPF and DKIM policies together and enforces alignment. Without DMARC, mailbox providers lack clear instructions on how to handle unauthenticated spoofed emails.

Create a new TXT record in your DNS zone with the following details:

• Name / Host: _dmarc.example.com
• Type: TXT
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100

Start with a policy of p=none to monitor reports without impacting live traffic. Once you verify that all legitimate mail streams pass authentication, you can upgrade your policy to p=quarantine and eventually p=reject.

Verifying Your DNS Changes

After publishing your records, propagation can take anywhere from a few minutes up to 24 hours depending on your TTL settings. You can verify your configuration locally using command-line tools or online diagnostics.

Use dig or nslookup in your terminal or PowerShell to check your DKIM CNAME propagation:

dig CNAME hubspot._domainkey.example.com +short

Expected output sample:

hubspot._domainkey.domain.com.cust.hs-send.com.

To check your DMARC record syntax and presence:

nslookup -type=TXT _dmarc.example.com

Once propagation is complete, return to your HubSpot settings dashboard and click the Verify button next to your connected domain. HubSpot will check the DNS zone and remove the warning flags if the records match precisely.

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into roadblocks when configuring marketing automation DNS. Review these common pitfalls to avoid extended downtime:

• Multiple SPF Records: Creating two separate v=spf1 TXT records will cause SPF validation to fail completely. Always combine multiple include statements into a single TXT record.
• Typocoded Hostnames: Accidentally adding your root domain twice in CNAME host fields (e.g., entering hubspot._domainkey.example.com.example.com) will break DKIM validation. Check your DNS manager's auto-append behavior.
• Trailing Periods: Some DNS providers require a trailing dot on CNAME target values (e.g., hubspot._domainkey.domain.com.cust.hs-send.com.), while others reject it. Follow your specific host's syntax conventions.
• Ignoring CNAME Flattening Limitations: Ensure your DNS provider supports CNAME records on the root domain if required, though HubSpot DKIM uses subdomain selectors that bypass root CNAME limitations safely.

Quick Checklist for HubSpot Deliverability

• Checked domain health using an external email security analyzer.
• Verified only one active SPF TXT record exists for your root domain.
• Added HubSpot's include:hubspotemail.net rule to your SPF string.
• Published all required HubSpot DKIM CNAME records accurately.
• Deployed a valid DMARC monitoring policy (p=none) with a reporting address.
• Confirmed green checkmarks inside your HubSpot domain settings dashboard.