Why is your Mailgun-to-HubSpot email bounce rate at 100%?

You sent one test email through Mailgun to HubSpot. It bounced. Then you sent ten more. All bounced. You checked the logs. The error? 550 5.1.3. You’re not alone.

That code means HubSpot rejected your message because your sender domain isn’t properly verified. It doesn’t matter if Mailgun’s SMTP works elsewhere—HubSpot enforces its own sender checks. The issue isn’t Mailgun. It’s your DNS.

Even if your Mailgun credentials are correct and your mail flows to Gmail, HubSpot won’t accept messages from domains it doesn’t trust. The root cause? Missing or misconfigured SPF, DKIM, or DMARC records.

Fixing “how to confirm Mailgun domain is properly configured for HubSpot 550 5.1.3 fix” means diagnosing DNS, not tweaking your API key. We’ll walk you through the exact checks, the records to double-check, and how to verify the setup without guesswork.

Key takeaways

  • The 550 5.1.3 error in HubSpot is caused by missing or incorrect SPF/DKIM/DMARC records, not Mailgun configuration issues.
  • HubSpot strictly enforces sender domain validation—Mailgun’s SMTP success doesn’t guarantee HubSpot delivery.
  • Use DNS lookup tools like MXToolbox or DNSLeakTest to verify SPF and DKIM records are published and correct.

The 550 5.1.3 Error: What It Really Means

When HubSpot returns a 550 5.1.3 error, it means the recipient server rejected your sender address as unrecognized—typically because it doesn’t recognize the domain as valid or authorized. This happens even if the recipient’s email exists and the domain is active; the problem is usually with your domain’s email configuration, not the recipient’s inbox. Let’s break down what’s really going on.

Why the Error Occurs (Even Without Typos)

HubSpot uses SMTP to send emails through your domain. If the domain isn’t properly configured—missing or incorrect DNS records like SPF, DKIM, or MX—HubSpot can’t prove it’s authorized to send from that address. The receiving server sees the sender as spoofed or invalid, hence the 550 5.1.3 rejection.

This isn’t about whether the email address is real. It’s about whether the sending domain is trustworthy. Even a correct "[email protected]" will fail if the domain doesn’t pass SPF checks, or if DMARC policy blocks it. It’s a common failure point when setting up transactional email systems with third-party platforms.

What HubSpot and Receivers Actually Validate

Receiving servers don’t just check if an email address exists—they validate sender legitimacy via DNS records. SPF verifies which servers are allowed to send for a domain. DKIM signs messages cryptographically. DMARC defines what to do when these checks fail. Without all three properly set, even a well-configured Mailgun setup can be blocked.

Mailgun handles the delivery, but HubSpot acts as the sender. If HubSpot’s outbound path fails to authenticate the domain, the receiving server treats it like spam or spoofing. The 550 5.1.3 code specifically signals that the recipient system doesn’t accept mail from that sender address, regardless of the recipient's existence.

For context, authoritative sources like RFC 5321 define SMTP error codes. The 550 5.1.3 code is explicitly for “mailbox not found” in the context of sender validation, even if the actual user inbox exists.

It’s tempting to think it’s a typo in the email or a misdelivered message. But in 90% of cases, the issue lies in DNS configuration, not the end user. You can’t fix this with more messages—only with technical validation. Use a tool that checks domain-level validity *before* sending. For example, bulk verification can catch invalid or improperly configured sender addresses before they trigger deliverability roadblocks.

How to Confirm Mailgun Domain is Properly Configured for HubSpot

Let's get your Mailgun domain properly set up so HubSpot stops rejecting emails with the 550 5.1.3 error. You must confirm domain ownership in Mailgun, publish SPF and DKIM records in DNS, ensure the sending domain matches exactly, and test delivery using Mailgun’s SMTP tool. A misconfigured domain is the most common cause of this error, and fixing it reduces bounces and improves deliverability.

Verify Your Domain Setup in Mailgun

  1. Log into your Mailgun account and navigate to the Domains section. Confirm that your sending domain (e.g., yourcompany.com) is listed here. If it’s missing, you haven’t added it yet. You must own the domain in Mailgun before it can send on your behalf.
  2. Check that the domain is verified and has “Active” status. A domain in “Pending” or “Suspended” state won’t send mail, even if DNS is correct. This is where the SPF standard (RFC 7208) applies — if Mailgun doesn’t recognize your domain, SPF checks will fail.
  3. Confirm your sending address uses the exact domain configured in Mailgun. Sending from [email protected] when Mailgun is set up for mycompany.com triggers a 550 5.1.3 error. The domain must match exactly.

Validate DNS Records and Test Delivery

  1. Check your SPF record in your DNS manager. It must include include:mailgun.org and end with a mechanism like -all or ~all. Without include:mailgun.org, the receiving server won’t trust Mailgun as an authorized sender. The v=spf1 prefix is required.
  2. Verify your DKIM record matches the selector and key published in the Mailgun dashboard. Use a tool like MXToolbox to verify the TXT record is published and correctly spelled. DKIM signing ensures email integrity and prevents spoofing.
  3. Use Mailgun’s built-in SMTP test tool to send a test message from your configured domain. If it arrives in the inbox, your setup is working. If it fails, check DNS propagation or retry after 15 minutes — DNS changes may take time to update globally.

If you're still hitting 550 5.1.3 errors after checking all these, your domain may be blocked or your sender reputation low. Tools like email list validation help you clean sender lists and reduce the risk of being flagged, especially when syncing with HubSpot. Keep your domain and email infrastructure consistent to maintain trust with mailbox providers.

Why Your SPF Record Must Include Mailgun

If your SPF record doesn’t include include:mailgun.org, HubSpot will reject your emails with a 550 5.1.3 error, even if DKIM passes. This is because SPF validates the sending server at the SMTP level, and HubSpot checks that your domain’s SPF record explicitly authorizes Mailgun’s servers. Without this, emails are flagged as spoofed, regardless of other authentication steps.

SPF Is Checked Early in the SMTP Handshake

When HubSpot receives an email, it checks the sender’s domain’s SPF record during the initial SMTP connection. This happens before DKIM or DMARC are evaluated. If the sending IP isn’t listed in the SPF record—or if Mailgun isn’t explicitly included—HubSpot rejects the message. Even a valid DKIM signature won’t override an SPF failure.

Let’s say you’ve set up Mailgun to send transactional emails for your HubSpot campaigns. You’ve configured DKIM correctly, and your domain is verified in both systems. But if your SPF record only lists your own server or a previous provider, Mailgun’s IP addresses won’t be authorized. The result? A hard bounce with error 550 5.1.3—your email is blocked before it even opens.

Adding include:mailgun.org Is Non-Negotiable

Mailgun’s official documentation confirms that SPF records must include include:mailgun.org for mail to be accepted by major email providers, including HubSpot. This is standard practice across email infrastructure. The [RFC 7208](https://tools.ietf.org/html/rfc7208) specification defines SPF as a mechanism to prevent sender address forgery, and it strictly enforces this validation at the server level.

Multiple email deliverability tools, including those used by enterprise senders, routinely flag missing include:mailgun.org entries as high-risk. It’s not just HubSpot—other platforms like SendGrid, Amazon SES, and even Gmail enforce this same rule. Ignoring it isn’t a configuration oversight; it’s a fundamental authentication failure.

If you’re still seeing 550 5.1.3 errors after checking DKIM, verify your SPF record with tools like MxToolbox or a DNS lookup service. Make sure the record contains include:mailgun.org and doesn’t exceed the 10 DNS lookup limit. If you’re managing a large list, validating email addresses before sending can prevent such issues from ever arising—automatically catching invalid, spoofed, or improperly configured addresses. You can clean and verify your entire list in minutes with bulk email list cleaning.

DKIM: How It Validates Mailgun Sends

DKIM ensures each email sent through Mailgun is cryptographically signed, so HubSpot and other receivers can verify it truly came from your domain. If the signature doesn’t match the public key in your DNS, the message fails — even with correct SPF. This is why a 550 5.1.3 error often persists after fixing SPF: DKIM is missing or misconfigured.

How DKIM Works During Mailgun Sends

When Mailgun sends an email, it generates a digital signature using a private key tied to your domain. This signature is added to the email headers. The receiving server — like HubSpot’s — retrieves the matching public key from your domain’s DNS records using a selector (a subdomain, like mailgun._domainkey.yourdomain.com).

Let’s say you’re using the selector “mailgun” and the domain “yourcompany.com.” The public key must be published in DNS as a TXT record at mailgun._domainkey.yourcompany.com. If HubSpot can’t retrieve it, or the signature fails verification, your message gets rejected.

Why HubSpot Depends on DKIM

HubSpot doesn’t just check SPF — it uses DKIM to confirm the email body and headers weren’t altered in transit. This is an industry-standard practice defined in RFC 6376. Even if SPF passes, a failing DKIM check leads to delivery issues, especially with strict receivers.

Many senders assume SPF alone is enough, but DKIM adds a critical layer of trust. Without it, messages may land in spam or get blocked outright — even if your Mailgun domain is otherwise correctly set up. Proper DKIM configuration is non-negotiable for reliable outbound delivery to HubSpot and other platforms.

For a deeper check, use a tool that validates your DNS records in real time. You can test your DKIM setup with tools like MXToolbox or DKIM Analyzer to confirm the public key is accessible and properly formatted.

Always verify your configurations before sending to large lists. Mistakes in DNS setup are a common cause of 550 5.1.3 errors. For bulk sends, ensure every email is valid and properly authenticated to maintain sender reputation and inbox placement.

If you're preparing a list for HubSpot via Mailgun, clean and verify it first. You can test your list’s deliverability and check for invalid or risky addresses with inbox placement testing or bulk email list cleaning to avoid unnecessary bounces and damage to your sender reputation.

How Email List Validation Stops 550 5.1.3 Before It Happens

You can prevent 550 5.1.3 errors when sending to HubSpot by validating your email list before integration. Invalid addresses, catch-all domains, and role accounts often trigger SMTP rejections. Running a pre-send check catches these issues early—keeping your sender reputation intact and your deliverability high. Use real-time API validation or bulk cleaning to verify addresses before they hit HubSpot’s servers.

Why 550 5.1.3 Happens at the Email Level

Mailgun’s 550 5.1.3 error usually means the recipient address isn’t recognized or the domain is misconfigured. But it can also stem from sending to invalid or non-deliverable addresses—even if Mailgun’s setup is correct. If your list includes outdated entries or role accounts like admin@ or marketing@, the recipient server may reject the message as undeliverable, even if Mailgun technically accepts it. This often happens because catch-all domains (which accept all emails) lack real inbox verification, so sending to them wastes resources and hurts sender reputation.

Proactive List Verification Is the Fix

Let’s be clear: Mailgun’s configuration isn’t broken just because you get a 550 5.1.3. The issue lies in sending to addresses that are unreachable or misleadingly accepted. You can test this by verifying a single email via the SMTP protocol or using tools like MXToolbox to check domain records. But that’s not scalable. A better way is to run your entire list through a validation system before sending.

Use real-time API validation or bulk verification to flag problematic addresses. These tools check syntax, domain existence, inbox reachability, and catch-all detection. They also identify role accounts, which are commonly flagged by HubSpot as high-risk. For example, an address like [email protected] may be a catch-all, not a real inbox, and cause a 550 5.1.3 even if the domain is valid.

With Email List Validation, you can clean your list in advance. Whether you’re using the real-time API for automated workflows or the bulk verification tool for one-time audits, you get accurate results with up to 98.9% precision. This reduces bounces, avoids blocklists, and keeps HubSpot happy by only sending to verified, valid addresses.

Verify Your Setup Across Multiple Channels

Test your Mailgun domain configuration by sending a message from Mailgun using the exact From address HubSpot will use, then check SPF/DKIM with MxToolbox, ensure the sending domain matches HubSpot’s From address, and confirm the 550 5.1.3 error appears in HubSpot’s event logs. This multi-channel validation catches configuration drift before it impacts delivery.

Send a Test Message from Mailgun

  • Use Mailgun’s SMTP or API to send a test email from the same From address HubSpot uses (e.g., [email protected]).
  • Send to a personal inbox—Gmail, Outlook, or ProtonMail—to verify the message arrives and is not blocked.
  • If the message fails with a 550 5.1.3 error, the issue is likely in your Mailgun or DNS setup, not HubSpot.

Check DNS Records and Event Logs

  • Visit MxToolbox and verify your domain’s SPF and DKIM records are published and correct—use the SPF Lookup and DKIM Record Checker tools.
  • Ensure the sending domain in Mailgun exactly matches the domain in the From address used in HubSpot—any mismatch triggers authentication failures.
  • Log into HubSpot, go to the Email Activity > Event Logs, and filter by the failed send. Confirm the error code is 550 5.1.3—this specific response indicates a rejected domain or missing authentication.
  • Check if the DNS records are propagated globally—some resolvers may cache old results. Wait 15–30 minutes after updates before re-checking.

Let’s be clear: a 550 5.1.3 error isn’t a HubSpot problem. It’s a deliverability signal from the recipient’s mail server. The code means “User unknown” or “Mailbox not found,” often caused by misconfigured MX records, missing SPF/DKIM, or domain mismatch.

Don’t rely on gut checks. Use tools like MxToolbox to validate the live state of your DNS records—many deliverability issues stem from undetected misconfigurations. And if you're managing large lists, verify each email address is deliverable before sending. Bulk clean your list to reduce bounce rates and avoid blocklists.

Common Mistakes That Cause 550 5.1.3 After Correct DNS Setup

Even with proper DNS records in place, Mailgun’s domain may still trigger a 550 5.1.3 error in HubSpot if you’re using a legacy or unverified domain, sending from an alias that doesn’t resolve to a real inbox, failing to re-authenticate after reusing a domain, or exceeding HubSpot’s sending limits. These often overlooked issues explain why delivery fails despite correct configuration.

Using a legacy or non-verified domain in Mailgun

If you’re still using an old or unverified Mailgun domain, even with correct DNS settings, HubSpot may reject the sender. Mailgun requires domain verification via DNS (TXT record) to confirm ownership. Without it, HubSpot sees the domain as untrusted, leading to a 550 5.1.3 bounce. Always confirm your domain is active and verified in Mailgun’s dashboard before use.

Aliases and unresolvable sender addresses

Sending from an alias like do-not-reply@ or noreply@ often causes 550 5.1.3 errors if the address isn’t mapped to an actual inbox. HubSpot verifies sender legitimacy, and it checks whether the "from" email resolves to a real user. If the mailbox doesn’t exist, the recipient server will reject it. Use only verified, active sender addresses to avoid this.

Similarly, some domains are set up as catch-alls, which accept all mail but don’t guarantee delivery. If HubSpot detects a catch-all, it may flag the sender as risky. The SMTP specification states that a sender address must be valid and deliverable—it’s not just about DNS, it’s about inbox presence.

Reusing domains without re-authentication

Even if you’ve used a domain before, HubSpot requires re-authentication after a break or domain change. The system stores sender reputation and authentication status. If you don’t reverify in HubSpot’s sender authentication settings after changing Mailgun setups or reusing a domain, HubSpot will treat it as untrusted, resulting in a 550 5.1.3 error.

Exceeding HubSpot's sending limits and throttling

HubSpot enforces strict rate limits and volume thresholds. Sending too many emails too quickly—even if the domain is verified—triggers throttling or rejection. You must stay within HubSpot’s allowed send windows. Check your plan’s daily and hourly limits. Exceeding them can result in 550 5.1.3 or similar delivery errors, regardless of DNS correctness.

Before sending, always validate your list to ensure sender addresses are active, real, and properly formatted. Clean your bulk list with an email verification service to catch invalid, role-based, or disposable addresses that could trigger delivery failures.

Integrating Mailgun with HubSpot: Do This Before You Send

Before sending through HubSpot using Mailgun, verify your domain is listed as a sender in HubSpot Settings > Email > Senders, confirm your campaign From address matches your authenticated domain, and clean your list with real-time validation to block disposable, role, or catch-all emails. Skipping these steps often leads to 550 5.1.3 errors and deliverability issues.

Step-by-step setup to avoid authentication problems

  1. Add Mailgun’s domain as a sender in HubSpot. Go to Settings > Email > Senders, and ensure your Mailgun domain appears in the list. If not, add it manually. HubSpot will only allow sending from domains it explicitly trusts.
  2. Match your From address to your authenticated domain. Double-check that the email address in your campaign’s From field uses your Mailgun domain (e.g., [email protected]). Mismatched addresses trigger authentication failures and increase the risk of being flagged as spam.
  3. Run your email list through real-time verification before import. Use a tool like the real-time verification API to identify invalid, disposable, or role-based addresses. This step reduces hard bounces and protects your sender reputation.
  4. Filter out catch-all, role, and disposable addresses. These types of emails often appear valid but don’t deliver reliably. Catch-all domains accept all emails, which can make your list look suspicious. Role addresses (like info@ or sales@) are frequently ignored or marked as spam. Disposable domains are temporary and typically used for fraud.
  5. Test your setup with inbox placement tools. After importing, use an inbox placement test to verify your message lands in the inbox—not the spam folder. Mailgun’s authentication setup (SPF, DKIM, DMARC) works best when the email list is clean and aligned with sender best practices.

Why this prevents the 550 5.1.3 error

The 550 5.1.3 error occurs when a receiving server rejects messages due to sender authentication failure or poor list hygiene. If your domain isn’t listed as a sender in HubSpot or if the From address doesn’t match your authenticated domain, the message will be blocked. This error is common when sending from unverified or mismatched domains.

According to RFC 5321, SMTP servers must verify sender identity. Mailgun requires proper DNS records (SPF, DKIM, DMARC), and HubSpot requires domain alignment in its sender list. Both must agree on the sender identity.

Using tools like Email List Validation helps you catch invalid, role, disposable, and catch-all addresses before they ever reach HubSpot. This prevents bounces, maintains your sender reputation, and ensures consistent delivery. You’re not just avoiding errors—you’re building reliability. Start with a clean list, align your domains, and verify every setup step before sending.

Why Real-Time Verification Saves Time and Inbox Placement

You can catch invalid, catch-all, or inactive addresses before they ever hit Mailgun or HubSpot, reducing bounces and protecting your sender reputation. This improves inbox placement with HubSpot and ISPs, and real-time API validation stops bad data at the source—saving hours of cleanup and re-engagement.

How It Works in Practice

When you integrate Email List Validation’s real-time API with HubSpot or Mailchimp, every new lead is checked instantly against SMTP, MX, and delivery logic. You’re not waiting for bounces to appear—they’re blocked before they’re sent.

More than 98.9% of addresses are evaluated accurately. That includes catching addresses that, while syntactically valid, are inactive or hosted on domains that accept all incoming mail (catch-all domains). These would otherwise cause soft bounces and hurt your deliverability over time.

Why Timing Matters for Deliverability

Spam filters and ISPs track sender reputation closely. A single high bounce rate—especially from HubSpot’s 550 5.1.3 error—can trigger a review or temporary block. Bounces from invalid or non-existent addresses signal poor list hygiene. By filtering these early, you maintain a clean sending record.

According to Return Path’s deliverability benchmarks, even a 0.5% bounce rate can impact inbox placement, particularly for transactional and marketing emails. Real-time validation helps you stay below that threshold.

Let’s say you’re onboarding leads at scale. Without verification, 2–5% of your list might be dead ends. With verification, those are flagged before they even reach Mailgun. That’s not just fewer bounces—it’s faster sender reputation recovery and higher long-term deliverability.

Use the real-time email verification API to validate entries as they’re added in HubSpot. Or clean your full list first with bulk email list cleaning to ensure your Mailgun domain is sending to addresses that actually exist.

Even if you're using Mailgun for transactional sends, verifying addresses at the point of collection means you’re less likely to trigger an SMTP 550 5.1.3 error on a non-existent recipient. This is the core of consistent inbox placement—clean data prevents errors. And clean data isn't just about reliability; it's about efficiency.

The Bottom Line: Fixing 550 5.1.3 Isn’t Just DNS — It’s List Health

Correct DNS configuration is essential to send through Mailgun, but it doesn’t guarantee delivery. Even with SPF, DKIM, and MX records set correctly, messages fail if they go to invalid, role-based, or catch-all addresses.

Real-time verification catches what DNS can’t

Many bounces stem from poor list hygiene, not misconfigured domains. Role accounts (like admin@, sales@) and catch-all inboxes often reject or silently drop messages. These are not valid recipients, and sending to them harms sender reputation.

  • Validating at the point of entry eliminates invalid addresses before they enter your workflow.
  • Preventing sends to dead or risky addresses reduces hard bounces and throttling.
  • Consistently clean lists improve long-term inbox placement and sender trust.

Sources

  • HubSpot's list-health benchmarks show an average bounce rate of 2.48% and an average unsubscribe rate of 0.22% across industries. — HubSpot (2025)

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 550 5.1.3 mean when sending from Mailgun to HubSpot?

It means HubSpot rejected the email because it couldn't verify the sender domain. Common causes include missing SPF/DKIM or sending from an unverified address.

Does Mailgun need to be listed in HubSpot’s sender list?

Yes — in HubSpot, go to Settings > Email > Senders and add your Mailgun domain as a verified sender before sending emails.

Can a catch-all domain cause a 550 5.1.3 error?

Yes — if the domain accepts all email but has no real inbox, HubSpot may reject the message as invalid.

How do I test if my Mailgun domain is properly configured?

Use tools like MxToolbox to check SPF and DKIM records. Test sending via Mailgun’s SMTP and check HubSpot logs for errors.

What happens if I send from a fake From address in HubSpot?

The recipient server, including HubSpot, will reject the email due to sender mismatch — often resulting in a 550 5.1.3 error.

How does email verification prevent 550 5.1.3 errors?

It removes invalid, role, catch-all, and disposable addresses before sending — reducing failures at the sender validation stage.

Do I need to re-verify DNS records after changing email campaigns?

Only if you change the From domain. DNS records should remain consistent unless you move to a new domain or hosting provider.

Can HubSpot reject an email even if Mailgun’s SMTP is working?

Yes — Mailgun’s SMTP can succeed in sending, but HubSpot performs its own validation. A 550 5.1.3 error indicates HubSpot rejected the message despite Mailgun's success.

How often should I validate my email list?

Before every major campaign, and at least monthly for ongoing lists. Use the real-time API for continuous validation.

Does Email List Validation support bulk verification with HubSpot?

Yes — use the Email List Validation tool to verify your HubSpot list in bulk, then sync clean addresses to your campaigns.