Connect your email sending domain

Before you send a single marketing email from HubSpot, you need to connect your email sending domain. This is not optional. Since Google and Yahoo tightened their authentication requirements in 2024, any email sent from an unverified domain goes straight to spam or gets blocked entirely.

I put this at step one of every marketing hub setup because everything else depends on it. Your nurture sequences, your campaign emails, your automated follow-ups: none of them reach anyone's inbox if your domain isn't authenticated.

The setup itself takes about fifteen minutes if you have access to your DNS provider. If you don't, it takes fifteen minutes plus however long it takes your IT team to respond to your email. Either way, it's a one-time task that determines whether your marketing emails actually arrive.

Why email authentication matters

Email authentication is how inbox providers (Gmail, Outlook, Yahoo) verify that an email claiming to be from your domain actually came from your domain. Without it, your emails look like they could be spoofed, and inbox providers treat them accordingly.

There are three authentication protocols you need to set up:

DKIM (DomainKeys Identified Mail). This adds a digital signature to your emails that proves they haven't been tampered with in transit. HubSpot generates two CNAME records for this.

SPF (Sender Policy Framework). This tells inbox providers which servers are allowed to send email on behalf of your domain. HubSpot provides a TXT record for this. If you already have an SPF record (common if you use Google Workspace or Microsoft 365), you add HubSpot to the existing record rather than creating a new one.

DMARC (Domain-based Message Authentication, Reporting and Conformance). This tells inbox providers what to do when an email fails DKIM or SPF checks: nothing, quarantine it, or reject it. You add a TXT record for this.

All three are required. Missing even one means your emails are "partially authenticated" at best, which still hurts deliverability.

What you need before you start

You need two things: your domain name (e.g. solidgrowth.com) and access to your DNS provider. Your DNS provider is the service that manages your domain's records. Common ones include Cloudflare, GoDaddy, Namecheap, and Route 53. If you bought your domain through your hosting provider, DNS is usually managed there too.

If you don't know who your DNS provider is, check with whoever set up your website. Or search "who is my DNS provider" and use a WHOIS lookup tool.

The setup process

In HubSpot, go to Settings (gear icon, top right), then Content, then Domains and URLs. Click the Email Sending tab, then "Connect sending domain".

Enter your domain (just the root domain, e.g. solidgrowth.com, not www.solidgrowth.com). HubSpot generates the DNS records you need: two CNAME records for DKIM, one TXT record for SPF, and one TXT record for DMARC.

Copy each record and add it to your DNS provider. The exact steps vary by provider, but HubSpot has a knowledge base article with instructions for the most common ones. If you use GoDaddy, HubSpot has a direct integration that can apply the records automatically.

After adding the records, click "Verify" in HubSpot. DNS changes typically propagate within 10-70 minutes, though some providers take up to 48 hours. HubSpot shows your authentication status as "Not authenticated", "Partially authenticated", or "Authenticated". You want all three protocols showing green.

Common mistakes

Creating a second SPF record. If you already have an SPF record (check with your DNS provider), you need to add HubSpot's include statement to the existing record. Two SPF records on the same domain will break authentication for all your email, not just HubSpot.

Connecting the wrong domain. Your sending domain must match the domain in your "from" email address. If your team sends from @solidgrowth.com, that's the domain you authenticate. If you also send from @marketing.solidgrowth.com, that's a separate domain that needs its own setup.

Skipping DMARC. Some teams set up DKIM and SPF but skip DMARC because it feels optional. It's not. Google and Yahoo explicitly require it for bulk senders.

Email domain authentication is the single most important technical setup in your marketing hub. Without it, nothing you build in HubSpot's email tools will reach your audience. Do this first, verify all three protocols are green, and then move on to everything else.