HubSpot email deliverability: connected domains and shared IPs

HubSpot sends marketing email from shared IPs that HubSpot maintains, so the IP reputation is mostly out of your hands and usually fine. What is in your hands is the sending domain, the contact list and the stream separation — and in that order, that is where nearly every HubSpot spam problem lives.

Connect an email sending domain first

Until you connect an email sending domain, HubSpot signs your mail with its own domain and the return path belongs to HubSpot. SPF and DKIM pass, but they pass for HubSpot, so DMARC does not align with your From domain. If your domain publishes p=quarantine or p=reject, that mail can be filtered outright.

Where it lives: *Settings → Website → Domains & URLs*, then connect a domain and choose Email sending. HubSpot generates the DNS records for you — DKIM CNAMEs on HubSpot-specific selectors, an SPF include, and a CNAME for the bounce and return-path subdomain. Publish all of them at your DNS host and let HubSpot verify.

The exact selector names and the CNAME targets are account-specific — copy them from the Domains & URLs screen in your own account, not from a screenshot in an article, because HubSpot can rotate the targets behind the CNAME.

Two details that trip teams up:

• The From address domain must be the connected domain. Connecting example.com and then sending from @mail.example.com leaves you unaligned again.
• Verify with a real message, not just the green tick. Send yourself a test, open the raw headers, and confirm dkim=pass with header.i=@yourdomain.com and dmarc=pass with header.from=yourdomain.com.

Then use what HubSpot already tells you

HubSpot's own tooling covers more than most teams use:

• The email health and deliverability view in the marketing email tool — bounce rate, spam-report rate and unsubscribe rate over time. The trend matters more than any single send.
• Bounced contacts are suppressed automatically; find them with a bounced-contact filter and remove them from your source of truth too.
• Graymail suppression and the unengaged segment. HubSpot can identify contacts who have not opened in a long window. Excluding them is the single most effective lever on a HubSpot complaint rate, because unengaged recipients are where complaints come from.
• Send-frequency caps limit how many marketing emails one contact receives, which protects you from three teams sending into the same list in the same week.

What HubSpot cannot tell you is folder placement. Like every ESP, its delivery figure is an acceptance figure.

The checklist, in order

1. Authenticate. Connect the email sending domain, publish every record, confirm alignment in real headers. Publish DMARC with a reporting address if you have not.
2. Prune. Suppress bounced contacts, exclude the unengaged segment, remove role addresses such as info@ and sales@ from marketing sends.
3. Separate streams. Marketing nurture, product notifications and one-to-one sales email should not share a subdomain. Sales email from the HubSpot CRM sends through the connected mailbox on Gmail or Microsoft 365, which is the right path for it — keep it there rather than routing outreach through marketing email.
4. Check content mechanics. A plain-text alternative, a visible unsubscribe link, no link-shortener domains, and an image-to-text balance that does not look like a flyer.
5. Ramp after any change of domain or volume. A newly connected sending domain is a new domain to receivers, regardless of how long your company has existed.
6. Measure placement independently with seed testing per provider, because Microsoft 365 and Gmail will disagree and HubSpot reports neither.

When a dedicated IP helps, and when it does not

HubSpot offers a dedicated IP as an add-on on higher tiers. It is worth it only with high, consistent monthly volume — enough to keep the IP warm continuously. Below that, the shared pool HubSpot maintains will outperform your cold IP, and a dedicated IP also means your own complaint rate is no longer diluted by anyone else's good behaviour. If the real problem is an unconnected domain or an unengaged list, a dedicated IP makes it worse.

What not to do

• Do not re-import bounced or unsubscribed contacts to re-engage them. That is how a complaint rate crosses Gmail's published 0.3% spam-rate threshold.
• Do not send a re-engagement blast to a two-year-old unopened segment from your main sending domain. If you must, do it in small batches and expect complaints.
• Do not point HubSpot's sending domain at the same subdomain as your cold outreach. Outreach complaints then land on your nurture mail.
• Do not rely on open rates to define "engaged". Apple Mail Privacy Protection and image proxies inflate opens; clicks and replies are the honest signals.
• Do not assume the DNS records are still there. A domain migration or a DNS provider change silently breaks DKIM, and the first symptom is a quiet drop in placement.

MailPilot does not plug into HubSpot, and we will not pretend otherwise. What it covers is the sending domain underneath: SPF, DKIM and DMARC verification, warm-up for the Gmail, Outlook or SMTP mailboxes your team sends from, real per-provider inbox placement through a seed network, and daily per-mailbox reputation tracking — the folder-level data no ESP dashboard can produce.