HubSpot lets you connect either a subdomain (such as email.yourcompany.com) or an eligible root domain as your email sending domain, and both authenticate the same way with DKIM, SPF, and DMARC. For most teams, a dedicated subdomain is the right choice: it isolates marketing and bulk email reputation from your corporate domain, keeps day-to-day business mail out of the blast radius if a campaign underperforms, and leaves your existing MX and mail routing untouched. Sending from the apex domain can work when leadership insists on exact-brand From addresses and the domain's reputation is strong — but it ties every marketing send to the same reputation your invoicing and executive email depend on. This guide compares the two options and walks through setup, DNS records, and the mistakes that hurt deliverability.
The email sending domain is the domain that appears in the From address of marketing email you send through HubSpot — and, more importantly, the domain receiving servers use to authenticate that mail. When you connect a sending domain in HubSpot settings, HubSpot gives you DNS records to publish: CNAME records for DKIM signing, an SPF include so HubSpot's sending servers are authorized, and an MX record that routes bounce and reply processing correctly. HubSpot accepts a subdomain or an eligible root (apex) domain for this connection.
Until a sending domain is connected and authenticated, HubSpot sends through shared HubSpot-managed domains. That works for a trial, but it caps your deliverability: your mail rides on a shared reputation, and mailbox providers increasingly expect bulk senders to authenticate their own domain. Google's and Yahoo's sender requirements make SPF, DKIM, and DMARC table stakes for anyone sending at volume.
Sender reputation is tracked largely at the domain level. Every spam complaint, bounce spike, and ignored campaign attaches to the domain in your From address — and that reputation is shared by everything else sent from the same domain.
That creates a real operational risk when marketing email and corporate email share an apex domain. A neglected re-engagement campaign that tanks engagement rates does not just hurt the next newsletter; it can slow delivery of invoices, contract notices, and password resets. The reverse is also true: a well-run marketing program on a dedicated subdomain can build excellent reputation without ever touching the corporate domain's standing.
DMARC adds a second dimension. If your apex domain enforces a strict DMARC policy (p=quarantine or p=reject), any unauthenticated or misaligned mail claiming that domain gets punished. Subdomains can inherit the organizational policy or carry their own via an sp= tag, so the choice affects how forgiving your authentication setup is during rollout.
| Factor | Dedicated subdomain (email.example.com) | Apex / root domain (example.com) |
|---|---|---|
| Reputation isolation | Strong — marketing reputation is separate from corporate mail | None — marketing and corporate mail share one reputation |
| Brand recognition in the From address | Good — the brand is still visible (example.com in the address) | Exact match to the corporate domain |
| DNS impact | Minimal — new records on a fresh subdomain; existing MX untouched | Higher care needed — SPF include must merge with existing SPF; MX changes can affect routing |
| DMARC alignment | Can align with the organizational domain; policy can differ via sp= | Must satisfy the apex policy directly — strict p= policies are unforgiving |
| Blast radius of a bad campaign | Contained to the subdomain | Can degrade delivery of all corporate email |
| Best for | Most organizations, especially higher-volume senders | Low-volume senders with exact-brand requirements and mature authentication |
The pattern deliverability teams have converged on is simple: corporate conversation on the apex, bulk and marketing mail on a subdomain. It mirrors what the mailbox providers themselves do.
Choose a subdomain if:
Consider the apex domain if:
When in doubt, start with the subdomain. Moving from apex to subdomain later means rebuilding reputation mid-flight; starting on a subdomain costs nothing and keeps every option open.
Vantage Point configures email sending domains, DKIM/SPF/DMARC authentication, and deliverability monitoring as part of HubSpot implementation engagements — and audits existing setups for teams whose marketing email is underperforming. For organizations running HubSpot alongside Salesforce, our HubSpot technology practice designs sending architectures that keep marketing, sales, and system email on the right domains from day one. Ongoing authentication and DNS stewardship also fits naturally into managed services and ongoing support.
Vantage Point is a HubSpot and Salesforce Solutions Partner and is employee-owned. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
Yes, HubSpot supports eligible root domains as email sending domains, authenticated with the same DKIM, SPF, and MX records as a subdomain. The trade-off is shared reputation: marketing email performance then directly affects the domain your corporate email depends on, so most teams use a dedicated subdomain instead.
Not meaningfully. Recipients see your brand in the visible From name and in the domain itself — email.yourcompany.com still reads as your company. Mailbox providers care about authentication and engagement, not whether the From domain is apex or subdomain.
HubSpot provides CNAME records for DKIM signing, an SPF include to authorize HubSpot's sending servers, and an MX record for bounce processing. You publish these at your DNS host, HubSpot verifies them, and a DMARC record on the domain completes the authentication picture.
Yes — a DMARC record on the subdomain (or an sp= policy on the organizational record) is needed for full alignment, and bulk senders are expected to have DMARC in place. Start with p=none while you verify alignment, then tighten the policy as monitoring confirms legitimate mail is passing.
You can connect a new sending domain and switch your From addresses, but the new domain starts with no reputation and needs its own warm-up period. That is why the subdomain-first approach is safer: it avoids a mid-life migration off an apex domain that has accumulated mixed reputation.
Transactional email sent through HubSpot's transactional add-on uses a dedicated sending infrastructure, and you authenticate a domain for it separately. The same subdomain logic applies — keeping transactional streams on their own authenticated domain protects their deliverability from marketing engagement swings.