hubspot.com

Live email deliverability and anti-spoofing audit. Every value below was read from public DNS at the moment this page was generated.

85/100 — Solid configuration with a few gaps worth closing. Accepts mail · Protected against spoofing · Hosted by Google Workspace

Findings

mx redundancy

Only one mail exchanger is published, so there is no failover.
```
smtp.google.com
```
Fix: Add a secondary MX at a higher priority number.
spf

SPF has no enforcing terminator, so unauthorised senders are neither marked nor rejected.
```
v=spf1 redirect=_hspf.hubspot.com
```
Fix: End the record with -all.
mta sts

No MTA-STS policy, so inbound mail can be downgraded to an unencrypted connection.

Fix: Publish _mta-sts.hubspot.com and host a policy at https://mta-sts.hubspot.com/.well-known/mta-sts.txt.
mx

Mail is handled by Google Workspace.
```
1 smtp.google.com
```

dmarc

DMARC is enforcing with p=reject.

v=DMARC1;p=reject;pct=100;rua=mailto:bdlk5ayo@ag.dmarcian.com;ruf=mailto:bdlk5ayo@fr.dmarcian.com

dkim

DKIM keys found for 5 selectors.

google._domainkey, s1._domainkey, s2._domainkey, mandrill._domainkey, hs1._domainkey

bimi

BIMI is published; supporting clients can show your logo.

v=BIMI1; l=https://www.hubspot.com/hubfs/hubspot_inc_1435039322.svg; a=https://www.hubspot.com/hubfs/hubspot_inc_1435039322.pem;

MX	`1 smtp.google.com`
SPF	`v=spf1 redirect=_hspf.hubspot.com`
DMARC	`v=DMARC1;p=reject;pct=100;rua=mailto:bdlk5ayo@ag.dmarcian.com;ruf=mailto:bdlk5ayo@fr.dmarcian.com`
DKIM selectors	`google`, `s1`, `s2`, `mandrill`, `hs1`
MTA-STS	not published
TLS-RPT	not published
BIMI	published
DNSSEC	validating

Run this check in your own code

Same data, as JSON, in one request. No SMTP probing, no stored recipient data, 250 free calls a month.

curl "https://mailgrade.dev/v1/domain?domain=hubspot.com"

Also available: /v1/verify?email=… for individual addresses, and /v1/verify/batch for lists.