Short answer
Email authentication is a set of DNS records that prove your marketing and CRM emails really come from your domain. SPF lists approved sending servers, DKIM adds a cryptographic signature, and DMARC tells inbox providers what to do with mail that fails. Gmail and Yahoo require them for bulk senders.
Email Authentication (SPF, DKIM, DMARC) explained
When you send email from HubSpot, Salesforce, Braze or another platform using your domain, you add DNS records that authorize that platform. Without them, emails are more likely to land in spam or be rejected. Many firms use a sending subdomain, such as mail.example.com, to protect the main domain's reputation.
Since 2024, Google and Yahoo have required SPF, DKIM, DMARC and easy unsubscribe for high-volume senders.
How Vantage Point helps: we set up email authentication and sending domains for HubSpot, Salesforce and Braze before your first send.
Frequently asked questions
Why do I need to change DNS records to send from HubSpot?
DNS records prove HubSpot is allowed to send on behalf of your domain, which improves deliverability and protects against spoofing.
What is a sending subdomain?
A subdomain used only for marketing email, which keeps marketing reputation separate from your main corporate email domain.