HubSpot powers email for more than 250,000 marketing teams. It sends through a mix of shared IP pools for most customers and dedicated IP options for higher-volume senders. Like any large ESP, HubSpot deliverability is partly a function of HubSpot infrastructure reputation and partly a function of how you configure your account, authenticate your domain, and manage your list.
This guide covers the specific configuration and operational practices that determine whether your HubSpot mail lands in the inbox or the spam folder.
- HubSpot has two distinct sending paths: connected inbox email (one-to-one sales mail) and marketing email (bulk campaigns). Each has different authentication requirements.
- Connecting your sending domain via the HubSpot Connected Email feature is the most important deliverability step. It enables DKIM signing aligned with your root domain.
- Most HubSpot customers send from shared IP pools. Reputation is partly inherited from pool neighbors and partly determined by your own sending behavior.
- Marketing email volume above roughly 250,000 sends per month is the rough threshold where a dedicated IP starts to make sense.
- HubSpot Delivery Insights and Health Score are useful internal signals but should be supplemented with Google Postmaster Tools and Microsoft SNDS data.
The Two Types of HubSpot Email
HubSpot sends email through two completely different systems. Confusing them is the most common source of deliverability issues for new HubSpot administrators.
Connected inbox email (one-to-one)
When a sales rep sends a personal email through HubSpot CRM, Sequences, or the Outlook/Gmail extension, the message is sent through their actual mailbox. The sending IP, server, and authentication are all controlled by Google Workspace, Microsoft 365, or whatever provider hosts the mailbox. HubSpot tracks opens and clicks but does not handle delivery.
Marketing email (bulk)
When you send a marketing campaign, automation email, or workflow email, HubSpot delivers the message through its own infrastructure. The sending IP belongs to HubSpot, the Return-Path is a HubSpot bounce domain, and authentication is HubSpot signed unless you have configured a connected domain.
Marketing email is where most HubSpot deliverability work happens. The rest of this guide focuses there.
HubSpot marketing email goes out through HubSpot servers using shared IPs by default. Your job as the sender is to authenticate your domain via the Connected Email feature, maintain a clean list, and keep complaint and bounce rates inside healthy ranges. Authentication is the single highest-leverage step.
Authentication: The Connected Email Setup
Before HubSpot will send marketing email from your domain, you must complete the Connect Email Sending Domain process. This adds two CNAME records to your DNS that enable HubSpot to sign messages with DKIM keys that align to your root domain.
The records look like this:
hs1._domainkey.yourdomain.com CNAME hs1.yourdomain.com.dkim.hubspotemail.net
hs2._domainkey.yourdomain.com CNAME hs2.yourdomain.com.dkim.hubspotemail.netHubSpot uses two CNAMEs to support DKIM key rotation. When a key needs to rotate, HubSpot updates the target of one CNAME while the other continues signing. This is invisible to you once configured.
Once both records resolve correctly and HubSpot validates the setup, your marketing email will be signed with DKIM that aligns to your From domain. You can verify alignment using a DKIM checker on any test message.
Tip: Verify your DKIM CNAMEs are resolving correctly before sending any marketing campaigns. A failed connected domain setup means messages will sign with HubSpot DKIM (d=hubspotemail.net) instead of your domain, breaking DMARC alignment and putting deliverability at risk.
SPF: Do You Need a HubSpot Include?
Because HubSpot uses its own envelope sender domain (Return-Path), you do not strictly need to include HubSpot in your SPF record for marketing email. The bounce path is HubSpot signed and SPF-aligned through the HubSpot bounce domain.
However, HubSpot recommends adding the include directive for belt-and-suspenders alignment in case SPF checking softens DKIM evaluation in any provider:
v=spf1 include:_spf.google.com include:23029108.spf08.hubspotemail.net ~allThe exact HubSpot SPF include string is unique to your portal and is provided in the Connect Email Sending Domain wizard. Watch the 10-lookup limit; if you already have several SPF includes, adding HubSpot can push you into SPF PermError territory. Audit your current record with an SPF checker before adding includes.
DMARC Alignment with HubSpot
Once Connected Email is configured properly, HubSpot marketing mail will pass DMARC through DKIM alignment. The d= tag in the DKIM signature matches your From domain, satisfying the alignment requirement under relaxed alignment mode (which is DMARC default).
If you publish a strict DMARC policy (p=reject) without first completing Connected Email setup, all HubSpot marketing mail will be rejected by DMARC-enforcing recipients. This is a common failure mode for organizations that deploy DMARC enforcement before auditing all third-party senders.
A safe rollout sequence:
- Complete HubSpot Connected Email setup.
- Send test campaigns and verify DKIM alignment in the received headers.
- Monitor DMARC aggregate reports for HubSpot sending sources (source IPs in 138.x and 50.x HubSpot ranges).
- Confirm 100 percent DMARC pass rate from HubSpot before advancing your policy to p=quarantine or p=reject.
Shared IP vs Dedicated IP on HubSpot
HubSpot uses shared IP pools by default. Customers send from a pool that includes many other HubSpot accounts, and your IP reputation is partly determined by the aggregate behavior of pool neighbors. HubSpot segments customers into different pools based on plan tier, sending volume, and historical complaint behavior, which limits the worst kind of neighbor risk.
Dedicated IPs are available as an add-on, typically for Marketing Hub Enterprise customers sending more than 250,000 emails per month. The rough decision math:
| Monthly Send Volume | Recommendation | Reasoning |
|---|---|---|
| Under 50,000 | Shared IP | Volume too low to build IP reputation; pool reputation works in your favor. |
| 50,000 to 250,000 | Shared IP | Borderline. Dedicated IP requires sustained volume to maintain reputation. |
| 250,000 to 1M | Either | Depends on industry and risk tolerance. Highly regulated industries may benefit from isolation. |
| Over 1M | Dedicated IP | Volume justifies reputation isolation and warmup investment. |
The full shared versus dedicated decision is more nuanced than volume alone. Industry, content type, recipient mix, and complaint risk all factor in.
If you move from shared to dedicated IP on HubSpot, expect a 4 to 6 week warmup period during which volume must ramp gradually. Send your most engaged segments first, monitor reputation in Google Postmaster, and resist the urge to push full volume in week one.
HubSpot Deliverability Tools
HubSpot includes several deliverability monitoring features that are useful but not sufficient on their own.
Email Health
The Email Health dashboard surfaces send volume, hard bounce rate, soft bounce rate, unsubscribe rate, and spam report rate over time. Watch for sustained spam report rates above 0.1 percent, which is the warning threshold before HubSpot may flag your account for deliverability review. Above 0.3 percent triggers automatic suppression or account holds.
Sending Limits and Health Score
HubSpot calculates an internal health score that informs sending limits and whether your account is in good standing. The score is opaque but reflects bounce rate, complaint rate, list quality, and engagement signals. A degrading score is the early warning that something needs attention.
Send Safe
For email recipients flagged as high risk (recent hard bounces, low engagement, manually marked unsafe), HubSpot will suppress or warn before sending. This protects shared pool reputation but means recipients you expect to receive mail sometimes do not. Audit your suppression list periodically.
Common HubSpot Deliverability Issues
Hard bounces from old contact lists
HubSpot imports often bring in stale CRM data. Without real-time email verification before send, the first campaign to a freshly imported list can produce hard bounce rates above 5 percent, which damages reputation immediately.
Promotions tab placement at Gmail
Marketing emails frequently land in the Gmail Promotions tab. This is normal and expected for promotional content but reduces engagement. Strategies to land in the Primary tab include reducing image weight, removing tracking-heavy templates, and writing more conversational subject lines.
DMARC failures from unauthenticated mail
If you send from HubSpot Marketing and HubSpot Sales (connected inbox) and from other tools using your domain, all those senders need authentication coverage in your DMARC reports. Missing coverage from a single tool can put pressure on your overall DMARC pass rate.
Sending to unengaged segments
The default HubSpot list builders make it easy to send to "all contacts," which usually includes long-dormant subscribers. Send those without segmentation and your complaint rate climbs while engagement metrics drop.
Monitoring Beyond HubSpot
HubSpot internal metrics show you what HubSpot sees: bounces, opens, clicks, unsubscribes, and spam reports that come back through feedback loops. They do not show you what Gmail or Outlook see at the reputation layer. For complete monitoring:
- Google Postmaster Tools: Add your sending domain and monitor domain reputation, IP reputation, spam rate, and delivery errors at Gmail.
- Microsoft SNDS: Request access for the HubSpot IPs your account uses, or rely on the SNDS data HubSpot publishes for shared pools.
- DMARC aggregate reports: Use a DMARC reporting service to monitor authentication pass rates across all sources, not just HubSpot.
- Independent seed list testing: Use a placement testing service quarterly to spot Promotions tab and spam folder issues before they become widespread.
Frequently Asked Questions
The most common causes are an incomplete Connected Email setup (HubSpot signing with its own domain instead of yours), high bounce rates from unverified lists, sending to unengaged contacts, or complaint rates above 0.1 percent. Verify DKIM CNAMEs first, then audit list hygiene and segmentation practices.
Yes. HubSpot supports DKIM signing aligned to your domain through the Connect Email Sending Domain feature, which adds two CNAME records to your DNS. SPF is satisfied through the HubSpot bounce domain by default, with an optional include directive available for additional alignment.
Navigate to Settings, then Domains and URLs, and choose Connect a Domain. Select Email Sending and follow the wizard. HubSpot will provide two DKIM CNAME records to add to your DNS provider. After DNS propagation, return to HubSpot to verify and activate the connection. The process typically takes 30 minutes including DNS propagation.
HubSpot has competitive deliverability when configured correctly. Its shared IP pools are well managed and authentication is comprehensive. Most deliverability issues on HubSpot trace back to customer configuration (incomplete Connected Email, poor list hygiene) rather than HubSpot infrastructure problems.
Dedicated IPs become beneficial when sustained monthly volume exceeds roughly 250,000 emails and ideally crosses 1 million per month. Below that, shared pool reputation generally outperforms a dedicated IP because warming and sustaining a dedicated IP at low volume produces inconsistent reputation.