HubSpot is unusual among email marketing platforms because it is primarily a CRM with email marketing layered on top, rather than an email platform that added CRM features. This architecture shapes every deliverability decision in ways that are not obvious from the HubSpot marketing materials — and it is the source of most of the HubSpot-specific deliverability problems I have helped organisations diagnose. The contact database that drives HubSpot's power — unified records across sales, marketing, and customer success — also drives the most common HubSpot deliverability failure mode: sending marketing email to contacts who were added to the CRM through sales channels that involved no email marketing consent.
This guide is for HubSpot teams that have moved past "how do I send a campaign" and are now asking "why is our inbox placement declining" or "how do we set this up properly before problems start." I will cover the authentication setup, the CRM-specific deliverability dynamics, and the specific settings that make a meaningful difference.
HubSpot Email Architecture: Understanding What You Are Actually Using
HubSpot has three distinct email products with different deliverability characteristics, different authentication configurations, and different operational considerations:
Marketing Email: Bulk email sent to contact lists — the newsletter, promotional campaigns, nurture sequences. This is what most people think of as "HubSpot email." Sent from HubSpot's marketing email infrastructure, authenticated under the connected sending domain, and governed by HubSpot's MAGY compliance requirements (List-Unsubscribe header, unsubscribe management, etc.). This is the product where custom domain authentication matters most and where list hygiene and consent management are critical.
Sales Email (Sequences): Individual or automated emails sent from the sales rep's connected Gmail or Outlook account through HubSpot CRM. These appear to recipients as personal emails from the sales rep — not marketing broadcasts. They are sent from the rep's actual email account (Google Workspace, Microsoft 365), not from HubSpot's email infrastructure. The deliverability considerations are different: Google Workspace or Microsoft 365 reputation applies, volume is individual (not bulk), and the compliance framework is B2B outreach rather than commercial marketing.
Transactional Email: Available on HubSpot's higher tiers, transactional email sends from HubSpot but without the marketing unsubscribe requirements — for use with receipts, account notifications, and other expected triggered communication. Requires separate configuration and cannot be used for commercial marketing content.
Understanding which product is handling which email is the foundation of HubSpot deliverability management — the problems and solutions are different for each, and organisations that confuse them spend time troubleshooting the wrong system.
Custom Domain Authentication: The First Thing to Fix
HubSpot's default authentication configuration sends marketing email with DKIM signed by hubspot.com rather than your organisation's domain. This works functionally — DMARC alignment is to hubspot.com — but means your email is authenticated as HubSpot's infrastructure rather than your brand, invisible in your DMARC aggregate reports, and not building reputation for your own sending subdomain.
# HubSpot custom domain DKIM setup: # Location: HubSpot → Settings → Website → Domains & URLs → Email Sending Domain # Step 1: Add your sending domain/subdomain in HubSpot settings # Use a subdomain: email.yourdomain.com or hs.yourdomain.com # Not the root domain: yourdomain.com # (Root domain creates DMARC alignment complexity) # Step 2: HubSpot generates two CNAME records — publish both in DNS: # hs1._domainkey.email.yourdomain.com CNAME hs1._domainkey.hubspot.com # hs2._domainkey.email.yourdomain.com CNAME hs2._domainkey.hubspot.com # (Exact values generated by HubSpot — use their generated records, not these) # Step 3: SPF for your sending subdomain: # email.yourdomain.com TXT "v=spf1 include:hubspot.com ~all" # Step 4: Verify in HubSpot settings — should show "Connected" after DNS propagation # (48-72 hours for full propagation; check with dig after 24 hours) # Step 5: Update From: address to use the subdomain: # from: Marketing Team <marketing@email.yourdomain.com> # This ensures DKIM and SPF both align to email.yourdomain.com # which satisfies DMARC under email.yourdomain.com # Step 6: Verify DMARC covers the subdomain: # _dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.com" # sp=quarantine applies the policy to subdomains including email.yourdomain.com # Confirm with mail-tester.com: # Send a test from HubSpot → check Authentication-Results header # Should show: dkim=pass (from email.yourdomain.com, not hubspot.com)
After completing custom domain authentication, register email.yourdomain.com in Gmail Postmaster Tools immediately. This subdomain now has its own sending reputation at Gmail, and Postmaster Tools will begin showing domain reputation data once sufficient volume is sent through it. This visibility is essential for monitoring whether the HubSpot sending subdomain's reputation is Good, Medium, or Low — information that is not visible in HubSpot's own analytics.
HubSpot Shared IP Pools: How They Work and What Affects You
HubSpot routes marketing email through shared IP pools maintained by their deliverability infrastructure team. All HubSpot marketing email customers share these pools — which means the sending behaviour of other HubSpot customers on the same IP pool can affect your deliverability. HubSpot monitors pool reputation and removes senders who generate excessive complaints or spam trap hits, but the shared pool dynamic is real.
HubSpot does not offer dedicated IPs for standard plans — dedicated sending infrastructure is available only through HubSpot's enterprise agreements at significant additional cost, and is typically only worthwhile for accounts sending above 2-3 million emails per month. For most HubSpot users, shared pool management is the relevant consideration: maintaining list quality and engagement metrics that do not negatively contribute to the pool's overall reputation.
The primary way individual HubSpot customers affect their own deliverability within the shared pool context: domain reputation. Because HubSpot signs email with your custom subdomain's DKIM keys, your domain reputation at Gmail accumulates separately from other HubSpot customers — even though you share IP addresses. A HubSpot customer with excellent list practices and high engagement builds Good domain reputation for their subdomain; a HubSpot customer with poor list practices builds Low domain reputation for their subdomain. The IP is shared but the domain reputation outcome is individual. This is why custom subdomain authentication is so important — without it, your sending is folded into HubSpot's overall domain reputation rather than building a reputation for your own subdomain that you control.
The CRM-Email Alignment Problem: Why HubSpot Deliverability Is Different
The most HubSpot-specific deliverability problem: the contact database is managed by sales teams who do not think in terms of email marketing consent, and the marketing team sends to that database assuming everyone in it has consented to receive marketing email. They have not. A sales rep who adds a prospective customer's contact information from a business card, a LinkedIn connection, or a trade show attendee list is adding a CRM contact — not an email marketing subscriber. The contact has not opted in to receive marketing communications from the company.
In HubSpot, this conflict manifests as: (1) Marketing campaigns sent to "All Contacts" or overly broad contact lists that include sales-sourced contacts who were never email marketing subscribers. (2) Nurture workflows automatically enrolling all new CRM contacts regardless of their acquisition source or consent status. (3) High complaint rates from recipients who receive marketing email from a company they remember only from a single sales conversation, not as a brand they signed up to hear from.
The solution requires alignment between the sales CRM workflow and the marketing email eligibility definition:
# HubSpot contact property approach to consent tracking: # Create a custom contact property: "Marketing Email Consent" # Values: "Explicit opt-in" | "Implicit consent" | "No consent" | "Opted out" # Set this property based on contact acquisition source: # Form submission with marketing consent checkbox → "Explicit opt-in" # Sales rep business card → "No consent" (cannot send marketing email) # Trade show scanner → depends on event consent disclosure # Co-registration partner → depends on partner consent disclosure # Marketing email lists should ONLY include contacts where # Marketing Email Consent = "Explicit opt-in" OR "Implicit consent" # (NEVER "No consent" or "Opted out") # HubSpot active list for marketing-eligible contacts: # List criteria: # Contact property "Marketing Email Consent" is equal to "Explicit opt-in" # OR # Contact property "Marketing Email Consent" is equal to "Implicit consent" # AND # Contact property "Email" is not null # AND # Contact property "Email subscription type" is not "UNSUBSCRIBED" # Exclude this list from all nurture workflows for non-consented contacts: # Workflow enrollment trigger: # Contact is added to list: [marketing eligible contacts list] # This ensures only consented contacts enter marketing workflows
Implementing this alignment prevents the most common HubSpot complaint spike: a marketing campaign or workflow that reaches sales-sourced contacts who generate complaints from recipients who never agreed to receive marketing email. The technical implementation is straightforward — a custom property and a list definition. The organisational implementation requires agreement between sales and marketing leadership on what "marketing eligible" means and how the sales team populates the consent field when adding contacts.
Workflow Email Deliverability: The Automated Sends Nobody Audits
HubSpot workflows — automated email sequences triggered by contact actions, lifecycle stage changes, or time-based criteria — are the dark matter of HubSpot email deliverability. Campaigns are reviewed before each send; workflows run continuously in the background after their initial configuration, often for months or years without anyone reviewing whether they are still performing appropriately.
I have audited HubSpot accounts with workflows configured 18 months ago that were: (1) sending to contacts who had been marked "Unqualified" by the sales team but never removed from the workflow enrollment; (2) continuing a 12-step nurture sequence to contacts who had already purchased the product 6 months ago; (3) sending re-engagement emails to contacts who had not opened any email in 24 months and whose engagement level made them high complaint risks; and (4) triggering off a CRM property that no longer existed, enrolling random contacts through a logic error.
The quarterly workflow audit: (1) List all active workflows with email sends. For each: review the enrollment trigger and verify it still makes sense with the current contact database. (2) Check the "unenrollment criteria" — every workflow should have clear exit criteria that remove contacts who are no longer appropriate recipients (purchased, churned, opted out, high complaint risk). (3) Review the sequence length and timing — workflows configured when the product was at an early stage may have email cadences that are too aggressive for the current, more mature customer base. (4) Check the "Currently enrolled" contact count and compare against expected — a workflow with 12,000 contacts enrolled when 5,000 seems appropriate indicates the enrollment trigger is too broad. (5) For lead nurture workflows, verify that the most recently enrolled contacts are actually leads rather than legacy contacts who should have been excluded years ago.
Contact Lifecycle Stages and Suppression Strategy
HubSpot's contact lifecycle stages (Subscriber, Lead, MQL, SQL, Opportunity, Customer, Evangelist, Other) provide a framework for suppression that most HubSpot accounts do not fully utilise for deliverability purposes.
The deliverability implications of lifecycle stage: "Customer" contacts have different email consent expectations than "Subscriber" contacts. A customer who purchased last year expects product updates, renewal notices, and account communications — they do not necessarily expect promotional acquisition campaigns. A Subscriber who opted in last week expects content marketing communications — they do not necessarily want sales outreach through Sequences. Mixing these audiences without lifecycle-based segmentation produces the engagement mismatch that generates complaints.
The suppression strategy aligned to lifecycle: (1) Exclude "Customer" contacts from acquisition-focused marketing campaigns. Customers should receive customer-specific communications (onboarding, product updates, renewal) rather than the same acquisition marketing that new subscribers receive. (2) Implement an engagement-based sunset for "Subscriber" contacts — remove from active marketing any subscriber who has not opened or clicked any email in 180 days. In HubSpot, this is an active list used as an exclusion in campaigns: exclude contacts where "Last Marketing Email Open Date" is more than 180 days ago. (3) Automatically move "Subscriber" contacts to a "Lapsed Subscriber" lifecycle stage after 180 days of inactivity — this allows targeted re-engagement campaigns rather than continued inclusion in general marketing.
HubSpot Sequences: B2B Outreach Deliverability
HubSpot Sequences are the B2B outreach product — automated follow-up emails sent from individual sales reps' connected email accounts (Google Workspace or Microsoft 365). The deliverability considerations for Sequences are the B2B cold email considerations documented throughout this site, applied to the specific context of HubSpot's sequence automation.
The critical distinction: Sequence emails come from the individual rep's actual email account — not from HubSpot's email infrastructure. The deliverability of a Sequence email depends on the rep's Google Workspace or Microsoft 365 account's reputation, their sending volume relative to what Google/Microsoft considers normal for that account, and the content of the Sequence emails themselves. HubSpot is the automation layer; the email infrastructure is the rep's corporate email account.
Volume limits for Sequences that protect the sales rep's account reputation: Google Workspace accounts can send approximately 2,000 emails per day without triggering rate limiting or spam classification. Microsoft 365 accounts have similar limits. A sales rep running aggressive Sequences to large prospect lists approaches these limits, particularly when the sequence includes multiple follow-up emails across a single day to different prospects. HubSpot enforces daily sending limits through Sequence settings — configuring a conservative limit (100-200 emails per day per rep) protects the rep's email account reputation and prevents the Gmail/Outlook rate limiting that would impair all email from that account, not just Sequence emails.
Subject line compliance for Sequences: the Washington State CEMA compliance considerations in the cold email guides apply to HubSpot Sequences. "Re:" prefixes in Sequence subject lines where there was no prior conversation are a CEMA violation risk. The "misleading" subject line standard applies to Sequences as commercial email. Review all Sequence templates for subject line compliance as part of the quarterly workflow audit.
Deliverability Monitoring for HubSpot Accounts
Inside HubSpot: HubSpot's marketing email analytics provide open rate, click rate, hard bounce rate, unsubscribe rate, and spam report rate per campaign and per email. The metrics to monitor: spam report rate (alert if above 0.05% on any single campaign — immediately investigate which list segment generated the complaints); hard bounce rate per campaign (alert if above 0.5% — indicates list quality decay in the segment used); open rate trend month-over-month (a persistent decline with stable list composition indicates deliverability degradation).
HubSpot does not provide Gmail Postmaster Tools-level domain reputation data natively. The HubSpot email health dashboard (Marketing → Email → Deliverability) provides a general health indicator but not the ISP-specific reputation data that Postmaster Tools delivers. For cross-ISP deliverability monitoring, external tools are required.
Outside HubSpot — essential: (1) Gmail Postmaster Tools for your custom sending subdomain (email.yourdomain.com or whatever you configured). Register the day you complete custom domain authentication. Review domain reputation chart weekly. The spam rate chart shows Gmail users' complaint rate for your domain — more accurate than HubSpot's spam report rate because it includes automated Gmail spam folder placement that users did not actively mark. (2) MXToolbox monitoring for your sending subdomain's authentication health — SPF, DKIM, and DMARC status checks to catch configuration changes that break authentication. (3) Weekly test send through GlockApps or mail-tester.com to verify inbox placement and authentication status are both correct before each major campaign.
HubSpot is a capable email platform when configured correctly — custom subdomain authentication, CRM-consent alignment, workflow auditing, and lifecycle-based suppression are the foundation of a HubSpot email programme that performs at or above industry benchmark. Most HubSpot accounts that struggle with deliverability are missing one or more of these foundations, usually the CRM-consent alignment piece — because it requires a cross-functional conversation between sales and marketing that most organisations find politically harder than any technical configuration. The technical work is straightforward; the consent alignment is the genuinely difficult part. But it is also the part with the most impact, because the consent problem is the root cause of the complaint events that damage domain reputation for every other email the account sends.