Hupspot email auth troubleshooting

Marketing email performance in Hubspot depends heavily on correct email authentication. When records such as SPF, DKIM, and DMARC are not set up correctly, your messages may fail, go to spam, or show warning banners in inboxes. This guide explains how to troubleshoot the most common authentication problems so your emails can send and deliver reliably.

How Hubspot email authentication works

Before you troubleshoot, it helps to understand how email authentication works around your sending domain, DNS, and the tools inside your Hubspot account.

Most issues relate to three DNS records:

SPF – tells inbox providers which servers can send on behalf of your domain.
DKIM – cryptographically signs your messages so recipients can verify they are legitimate.
DMARC – sets policy rules for how receivers should handle messages that fail SPF or DKIM.

Hubspot uses these records to prove your messages are authorized and not spoofed. If any record is missing, misconfigured, or conflicts with other settings, you may see errors inside your email tool or in inboxes.

Common Hubspot email authentication issues

Authentication issues usually fall into a few categories. Recognizing the pattern makes troubleshooting faster and easier.

Hubspot shows a domain verification error

When you connect a sending domain, you may see an error that your domain could not be verified. Usually this means one or more DNS records have not propagated, are mistyped, or were added to the wrong host name.

Typical causes include:

SPF record missing the Hubspot include statement.
DKIM CNAME records added to the wrong subdomain or with extra text.
Changes not yet propagated across DNS (can take several hours).
DNS records created as TXT when they should be CNAME, or the reverse.

Emails appear as “via” or “on behalf of” another sender

Some inbox providers add a “via” or “on behalf of” label if SPF or DKIM does not align with your from address. This can look unprofessional and may reduce trust with recipients.

This issue is often caused by:

Sending from a free webmail domain instead of your own domain.
Missing or incorrect DKIM records for the domain used in the from address.
SPF alignment problems where the envelope sender differs from your visible from domain.

Hubspot emails land in spam or show warning banners

Spam placement and warning banners often indicate broader authentication problems. Even if messages are sent, failing SPF or DKIM checks can trigger filters.

Common reasons include:

SPF record exceeding the DNS lookup limit.
Multiple SPF records instead of a single combined entry.
DMARC policy set too strict (for example, reject) while SPF and DKIM still fail.

Step-by-step Hubspot authentication troubleshooting

The steps below walk through a structured way to diagnose and fix issues related to SPF, DKIM, and DMARC for your connected domains.

1. Confirm your sending domain in Hubspot

Sign in to your account.
Navigate to your email or domains settings.
Locate the sending domain you use for marketing emails.
Check its status to see whether it is connected and verified.

If the status shows errors, open the detailed instructions provided in the settings area. You will see the exact DNS records that must be added for your provider.

2. Verify SPF for Hubspot

SPF must explicitly authorize Hubspot to send on behalf of your domain. Make sure your DNS includes a single SPF record that covers all sending services.

General guidance:

Keep only one SPF TXT record at the root of the domain.
Merge other services into the same record using include mechanisms.
Avoid chaining too many includes so you do not exceed the DNS lookup limit.

After updating SPF, wait for DNS propagation and then use an SPF lookup tool or built-in status check in your platform to confirm that Hubspot is included and the record is valid.

3. Confirm DKIM CNAME records

DKIM requires CNAME records that point from your domain to the signing keys provided in your email tool. If those CNAME records are wrong, DKIM verification will fail.

To check DKIM:

Copy the host names and values shown in your domain connection instructions.
Open your DNS provider’s control panel.
Ensure you created CNAME records, not TXT records, for each DKIM host.
Remove any extra spaces, prefixes, or suffixes that were not in the original values.

Once saved, allow time for DNS to propagate. Then resend a test email and inspect the authentication results. You should see DKIM pass for the domain you configured.

4. Review DMARC behavior

While DMARC is not required to send, it strongly influences how receivers treat your messages. If DMARC is present with a strict policy, but SPF or DKIM are failing, legitimate mail can be rejected.

Basic checks include:

Confirm the DMARC TXT record is attached to the correct host (usually _dmarc).
Review the policy (p=none, p=quarantine, or p=reject).
Start with p=none while you fix SPF and DKIM issues.

Use DMARC reports, if configured, to see how mailbox providers evaluate messages sent from Hubspot and other platforms.

Testing Hubspot email authentication

After performing changes, always test before sending a campaign to your full list. Testing provides a clear picture of how inbox providers interpret your new settings.

Send test emails from Hubspot

Create or open any marketing email draft.
Use the test send feature to email a small internal group.
Check headers in those test messages to confirm SPF, DKIM, and DMARC results.

Most email clients allow you to view original message details or raw headers. Look for lines indicating spf=pass and dkim=pass next to your domain. These results show authentication is functioning correctly.

Use external diagnostics tools

You can also send messages to external testing services that analyze DNS configuration and message headers. These tools highlight any remaining issues, such as alignment failures or DNS lookup errors.

Always cross-check the tool’s recommendations with the official guidance from the original documentation at this email authentication troubleshooting article to ensure your configuration follows the most accurate, up-to-date instructions.

Best practices for stable Hubspot email delivery

Beyond fixing individual records, you can follow several durable practices that keep authentication stable over time, even as your marketing program grows.

Use a dedicated business domain or subdomain for marketing emails.
Document all current SPF, DKIM, and DMARC settings before making changes.
When adding new tools, update SPF in one central record instead of creating multiple records.
Review DNS changes whenever you migrate hosting, change registrars, or adjust name servers.
Monitor spam folder placement periodically to catch emerging issues early.

If your team needs strategic support, you can also work with a specialist partner. For example, Consultevo provides consulting and technical guidance that can complement your internal configuration work.

When to contact Hubspot or your DNS provider

Some authentication issues require direct help from either your DNS provider or your marketing platform’s support team. Knowing who owns which part of the configuration can save time.

Contact your DNS or hosting provider if:

You cannot add or update TXT or CNAME records.
Changes do not appear even after long propagation times.
The control panel does not allow the record formats you need.

Contact the support team for your email platform when:

Records appear correct in DNS but verification still fails.
System messages report an internal configuration error.
You suspect an issue with how the platform signs or routes mail.

Gather recent examples of failed or suspicious messages, plus screenshots of your DNS records, before creating a ticket. This information helps support teams quickly confirm whether the problem is with DNS, configuration inside your account, or external factors.

Summary

Effective email authentication is essential for consistent delivery of your marketing campaigns. By carefully checking SPF, DKIM, and DMARC records, verifying your sending domain, and testing messages, you can diagnose and correct most issues that affect trust and inbox placement. Aligning your DNS configuration with the documented requirements ensures that your messages are authenticated correctly and that subscribers receive the content you intend to send.

Need Help With Hubspot?

If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.

Scale Hubspot

“`