Skip to content
healthcheck.email Sign in

Known quirk

HubSpot's SPF may not line up with your domain

We didn't find a custom return path for HubSpot, so its SPF won't line up with your domain. That's normal for HubSpot. Your mail is still authenticated, because HubSpot signs it with your own DKIM key.

What this means for you

  • Nothing to change while DKIM keeps signing.
  • In DMARC reports, HubSpot mail shows SPF not aligned and DKIM aligned. That's expected.
  • HubSpot's Marketing Hub Enterprise can use a custom return path, which lines SPF up too. If you have one on a subdomain we don't check, this note doesn't apply.

If HubSpot mail stops signing with DKIM, your report shows it as a gap.

Why it happens

Every email carries two from addresses: the one people see, and a hidden one where bounces go. SPF checks the hidden one. By default HubSpot uses its own return path for bounces, so SPF can pass without matching your domain. DMARC only needs SPF or DKIM to match, and DKIM does.

Technical detail

With HubSpot's default return path, the envelope sender (RFC5321.MailFrom) is a HubSpot domain, so SPF isn't aligned with the RFC5322.From domain. A custom return-path subdomain is what allows SPF alignment. DMARC passes through the aligned DKIM signature (RFC 7489 §3.1).

hubspot.spf_default_return_path

Sources

Reviewed by healthcheck.email on 2026-10-09.