SPF lists the servers allowed to send email for your domain. DKIM signs each message so the receiver can check it came from your domain and wasn't changed on the way, and DMARC tells receivers what to do when those checks fail and where to send reports. Every tool that sends email as your domain needs to be covered. Authentication won't guarantee the inbox, but Gmail says messages without it might be marked as spam or rejected.
Start here, before DNS. Google's sender guidelines put it plainly: "The SPF record for your domain should include all email senders for your domain." You can't include senders you don't know about.
Write down every tool that sends email with your domain in the From address. Check each of these:
Some tools send from their own domain unless someone has set them up to send as yours. Note which is which. The ones sending as you are the ones you need to cover.
We'd write this list before touching a single DNS record.
Before you change anything, copy your current DNS records into a document. If an edit goes wrong, you'll want the old values.
Then look up what's live. HubSpot's own troubleshooting steps point to MX Toolbox's SPF Record Check and dmarcian's DMARC Record Checker. Look for these:
HubSpot calls this connecting an email sending domain. Its help page lists the feature for Starter, Professional and Enterprise subscriptions, and you'll need Domain settings permissions and a login for your DNS provider.
One catch first. HubSpot says you can only connect a sending domain that isn't already in use for something else, such as hosting your website. You can connect a subdomain like info.yourdomain.com instead, and it should match the domain in the From address you send marketing email from. If your DNS is on Cloudflare, HubSpot also says to make sure domain-wide CNAME flattening and proxy settings are turned off.
Back on the Email Sending tab, each domain shows Not authenticated, Partially authenticated or Authenticated. HubSpot says DNS changes usually take between 10 and 70 minutes but can take as long as 48 hours, so don't panic if it doesn't flip right away.
Then do the same for every other tool on your list, using that tool's own instructions.
DMARC has a policy setting, and you don't have to start strict. DMARC.org's own deployment steps are: set up DKIM and SPF, make sure your senders align, "Publish a DMARC record with the 'none' flag set for the policies, which requests data reports," analyze the data, then move from "none" to "quarantine" to "reject" as you gain experience.
A monitoring record looks something like this, with your own reporting address:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
With p=none, you're asking for reports, not telling receivers to block anything. The reports show which servers are sending as your domain and whether they pass. That's the second half of your sender list: anything in the reports that isn't on your list needs explaining.
We wouldn't move to quarantine until the reports show every tool on your list passing. There's no fixed timeline for that. It depends on how many tools you have and how quickly you fix each one.
Both publish sender requirements. Quoting them, as of Nov 3, 2026:
For bulk senders, both also say the domain in your From address has to line up with the SPF or DKIM domain for DMARC to pass. Both pages change from time to time, so check them yourself before relying on any detail here.
Authentication proves the mail is really from you. It doesn't make anyone want it.
Google's guidelines say to "send email only to people who want to get messages from you," and warn that if your messages are often reported as spam, future messages are more likely to land there. Yahoo says not to buy mailing lists or pre-check opt-in boxes. If your list includes people who never asked to hear from you, fixing DNS won't change how they react.
Google only requires it for bulk senders, but it recommends SPF, DKIM and DMARC for every domain. A p=none record asks for reports without telling receivers to block anything, so it's a reasonable place to start.
No. The SPF standard says a domain must not have multiple SPF records. Combine every sender into one record, with one v=spf1 at the start and one -all at the end, the way HubSpot's own SPF example does.
HubSpot's email authentication page lists connecting a sending domain for Starter, Professional and Enterprise, not Free. Check what your account shows under Domains & URLs. The other tools that send as your domain still need covering either way.
Not on its own, and nobody can promise that. Google says authenticated messages "are less likely to be rejected or marked as spam." List quality and whether people want your email still matter.
Authentication comes down to a few DNS records, but the tools behind them are usually the same CRM, forms and follow-up that bring your leads in. Our $149 Setup Review looks at how leads reach you today and gives you a written list of next steps. Want a second set of eyes on your setup? See how the Setup Review works, or book a call.
Sources: HubSpot Knowledge Base: Manage your email authentication. Google: Email sender guidelines. Yahoo: Sender Requirements & Recommendations. DMARC.org: Overview. IETF: RFC 7208, Sender Policy Framework.
Independent. Not affiliated with HubSpot, Google or Yahoo. HubSpot is a trademark of HubSpot, Inc. Gmail, Google Workspace, Yahoo, Microsoft 365, QuickBooks, Xero, Stripe, Zapier, Make, Cloudflare, MX Toolbox and dmarcian are trademarks of their respective owners.