Your HubSpot email open rates dropped from 25% to 12% over three months. Your sales team complains that prospects aren't responding to follow-up sequences. Your boss wants to know why email marketing isn't working anymore.
The problem isn't your subject lines or send times. Your emails are landing in spam folders because your SPF record isn't configured for HubSpot.
I see this constantly when auditing portals. Marketing teams spend months perfecting email copy, segmenting lists, and A/B testing campaigns. But they never set up the technical foundation that actually gets emails delivered.
Your emails might be brilliant, but they're useless if Gmail and Outlook dump them in spam before anyone sees them.
Most companies set up their domain's basic SPF record when they first configure email. This tells other email servers which systems are allowed to send emails from your domain. But they forget to include HubSpot in that authorization.
Here's what happens: you send a marketing email through HubSpot using your company domain. The recipient's email server checks your SPF record to verify that HubSpot is authorized to send emails on your behalf. Your SPF record says nothing about HubSpot. The email server assumes the email is spoofed or spam.
Your perfectly crafted email goes straight to junk folders, and you never know why.
This isn't a HubSpot problem. It's a domain configuration problem that affects every marketing automation platform. But since most IT teams set up SPF records before implementing marketing automation, HubSpot gets left out of the authorization.
When emails land in spam, your metrics tank across the board. Open rates plummet because people don't check their spam folders regularly. Click rates disappear because you can't click links in emails you never see.
But here's the part that really hurts: your sender reputation deteriorates over time. Email servers start treating all emails from your domain as suspicious, even the important sales follow-ups and customer communications your team sends manually.
You're not just losing marketing email performance. You're damaging your entire organization's email credibility.
Most marketing teams don't realize this connection. They see declining open rates and assume their content isn't resonating or their lists are getting stale. They try different subject lines, adjust send times, or clean their contact database. None of that fixes the underlying deliverability problem.
HubSpot email domain authentication requires three DNS records: SPF, DKIM, and DMARC. Most portals I audit have none of them configured correctly.
SPF is the foundation. It's a DNS record that lists which mail servers can send emails from your domain. Without it, every email you send through HubSpot looks suspicious to recipient servers.
DKIM adds a digital signature to your emails that proves they weren't tampered with during delivery. DMARC tells other email servers what to do when emails fail SPF or DKIM checks.
Your IT team probably set up basic SPF when they configured your company email, but they didn't include HubSpot's mail servers in the authorization. This is normal because they set up email infrastructure before you started using marketing automation.
The fix requires updating your existing SPF record to include HubSpot, then adding DKIM and DMARC records for complete authentication.
Here's a scenario I see constantly: imagine your marketing team creates a lead nurture sequence for trial signups. Five emails over two weeks, each one designed to move prospects toward a sales conversation.
Email one introduces your product and gets decent engagement. Email two shares a case study but open rates drop. Email three offers a demo but barely anyone clicks. By email four, opens are in single digits.
You assume the sequence is too aggressive or the content isn't relevant. But the real problem is progressive spam filtering. Each email that lands in spam makes the next email more likely to be filtered.
Your prospects never see the case study, never get the demo offer, never book sales calls. Your nurture sequence fails not because of poor content, but because of poor deliverability.
The sales team blames marketing for low-quality leads. Marketing blames sales for not following up effectively. Meanwhile, the actual problem is technical infrastructure that nobody thinks to check.
Setting up HubSpot email domain authentication involves working with whoever manages your company's DNS records. This might be your IT team, your web developer, or your domain registrar.
Search for email domain authentication in your HubSpot settings. You'll see options to authenticate your domain for email sending. This process generates specific DNS records that need to be added to your domain configuration.
The SPF record tells email servers that HubSpot is authorized to send emails from your domain. The DKIM record provides a digital signature that proves email authenticity. The DMARC record specifies how other servers should handle emails that fail authentication checks.
Most marketing teams get stuck at this step because they don't have DNS access and need to coordinate with technical team members. Don't let this stop you. The setup takes about 30 minutes once you have the right person involved.
Once your domain authentication is configured correctly, email deliverability improves gradually over several weeks. Email servers need time to recognize your improved sender reputation.
You'll see open rates climb back to normal levels first. Then click-through rates improve as more people actually receive your emails. Response rates to sales sequences increase because prospects are seeing your follow-ups.
But the biggest change is reliability. Your email marketing becomes predictable again. When you send a campaign to 1,000 people, you know most of them will actually receive it.
This reliability lets you make better decisions about email frequency, content strategy, and campaign optimization. You're no longer guessing whether poor performance is due to deliverability issues or content problems.
Your sales team stops complaining about unresponsive prospects. Your boss stops questioning why email marketing ROI looks terrible. Your marketing attribution starts working because people can actually receive and engage with your campaigns.
Check your current SPF record to see if HubSpot is included. Search online for "SPF record checker" and enter your domain. Look for references to HubSpot or MailChimp servers in the results.
If you don't see HubSpot mentioned in your SPF record, your emails are probably getting flagged as spam. If you see error messages about SPF record limits or formatting, you have technical issues that need fixing.
Most portals I audit fail this basic check. Their SPF records were configured years ago for basic email service, but never updated for marketing automation. It's an easy fix that dramatically improves email performance.
The hardest part isn't the technical setup. It's realizing that your email marketing problems might be infrastructure issues, not content or strategy problems.
Wondering if this is happening in your portal? I'd be happy to take a look at your setup and identify what needs attention. Email authentication issues are common, but they're fixable once you know what to look for.