Email deliverability is not a marketing problem. It is an infrastructure problem that shows up as a marketing problem. When emails go to spam, the visible symptom is low open rates. The root cause is usually a combination of missing authentication records, a degraded sender reputation from prior sends, or a list quality issue that has been accumulating for months. Fixing the symptom (better subject lines, different send times) without fixing the root cause produces no lasting improvement.
HubSpot provides the tools to configure email authentication, monitor deliverability metrics, and manage list quality. But HubSpot cannot fix authentication records in your DNS, remove spam traps from your list, or change the engagement pattern of recipients who have stopped opening your emails. Those require deliberate action outside the platform, followed by the right HubSpot configuration to support them.
The Three Authentication Records Every HubSpot Sender Needs
SPF (Sender Policy Framework)
SPF is a DNS TXT record that specifies which servers are authorized to send email on behalf of your domain. For HubSpot, you add HubSpot's sending servers to your SPF record so receiving servers know that email from HubSpot claiming to be from your domain is legitimate. Without an SPF record that includes HubSpot, your emails are more likely to be marked as suspicious or rejected outright by corporate email systems.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every email HubSpot sends from your domain. The receiving server checks the signature against a public key published in your DNS to verify that the email was not altered in transit. HubSpot generates a DKIM key pair for your account; you publish the public key in your DNS as a CNAME record. Once configured, every email from your HubSpot account carries a valid DKIM signature, which significantly improves inbox placement with major providers.
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC tells receiving servers what to do when SPF or DKIM checks fail, and sends you aggregate reports about authentication results for emails sent from your domain. A basic DMARC policy set to p=none (monitoring mode) lets you see which sources are sending email claiming to be from your domain without blocking anything. Once you have confirmed all legitimate sending sources pass authentication, you can move to p=quarantine or p=reject to actively protect your domain from spoofing.
| Record | Where it goes | What it does | Required? |
|---|---|---|---|
| SPF | DNS TXT record | Authorizes HubSpot to send on your behalf | Yes |
| DKIM | DNS CNAME record | Signs emails to verify authenticity | Yes |
| DMARC | DNS TXT record | Policy for auth failures + reports | Yes (start with p=none) |
Email Deliverability
Want your HubSpot emails landing in inboxes instead of spam folders?
We configure SPF, DKIM, and DMARC for HubSpot, audit list quality, implement engagement-based suppression, and set up the deliverability monitoring that keeps your sender reputation clean. Book a call.
Book a Free CallList Quality: The Ongoing Deliverability Work
Engagement-Based Suppression
Inbox providers track how recipients interact with your emails and use those signals to determine where future emails from your domain should land. A high proportion of recipients who delete your emails without reading them, or worse, mark them as spam, damages your sender reputation across all sends. The fix is proactive suppression of unengaged contacts before they accumulate into a deliverability problem.
In HubSpot, build an active list of contacts who have received at least 5 marketing emails in the past 90 days and have not opened any of them. Suppress this list from your regular campaigns. Send one targeted re-engagement email to the list with a clear value proposition and an explicit opt-in ask. Contacts who engage stay active; those who do not are removed from your marketing list and set to non-marketing contact status in HubSpot. Run this process quarterly.
Hard Bounce Management
HubSpot automatically suppresses hard bounces from future sends. But a high hard bounce rate on a specific campaign or import is a signal that the source list has a problem: old or invalid email addresses, a purchased list, or records that were never verified. For any import that produces a hard bounce rate above 2 percent, identify the source and address it before the next send from that list. Do not re-import corrected versions of bounced addresses — if the address hard bounced once, treat it as invalid until the contact updates it directly through a form or conversation.
The Four Deliverability Metrics to Monitor Monthly
- Hard bounce rate: target below 2%. Above this, review list sources.
- Spam complaint rate: target below 0.1%. Above this, review content and suppression practices.
- Unsubscribe rate: a rate above 1% on a campaign signals a relevance or frequency problem.
- Open rate by engagement segment: track opens separately for recently active contacts vs. contacts you have not heard from in 90+ days to see the true health of your sending reputation.