Why does HubSpot Mailgun return a 550 5.1.3 'domain unknown' error?

You send a campaign from HubSpot using Mailgun, and it fails. The error: 550 5.1.3 'domain unknown'. You check the email address—valid. The recipient? Real. So why does the mail server refuse it?

It’s not about the email’s quality. It’s about the domain. The receiving server can’t find your domain in DNS. It’s like trying to deliver a letter to a street that doesn’t exist. Even if the house number is correct, the post office won’t accept it.

You’re not alone. This error surfaces when a domain’s DNS records are missing, misconfigured, or not publicly resolvable. It’s a technical gatekeeper: no DNS entry, no delivery. The issue isn’t the email—it’s the domain’s visibility on the internet.

Fixing this isn’t about rewriting your email content. It’s about verifying that your sending domain is properly published in DNS, and that SPF aligns with how the server is set up. We’ll walk through the exact checks—DNS lookups, SPF validation, and common missteps—to resolve 550 5.1.3 and keep emails flowing.

Key takeaways

  • The 550 5.1.3 error means the recipient’s mail server cannot find your domain’s DNS records, blocking delivery regardless of email validity.
  • Even if your email address is syntactically correct, a missing or misconfigured MX or A record will cause this error.
  • SPF misconfiguration—especially overlapping or conflicting policies—is a frequent root cause behind "domain unknown" failures when using Mailgun with HubSpot.

What’s the root cause of 550 5.1.3 in HubSpot Mailgun integrations?

The 550 5.1.3 "domain unknown" error in HubSpot-Mailgun setups usually means your sending domain lacks a valid SPF record or hasn't completed DNS ownership verification. Without proper SPF, Mailgun can't prove it’s authorized to send on your domain’s behalf, and receiving servers reject the message. This is not a Mailgun issue—it’s a DNS misconfiguration on your end.

SPF is the gatekeeper

Let’s be clear: Mailgun won’t send for you unless you verify domain ownership via DNS. That verification requires a properly formatted SPF record. If the record is missing, malformed, or doesn’t include Mailgun’s IPs, servers treat your domain as untrusted—even if it’s technically valid.

SPF checks are the first line of defense in email authentication. Without it, even valid emails get blocked. The RFC 7208 standard defines SPF as a DNS TXT record that specifies which hosts are permitted to send mail for a domain. You can check your domain’s current SPF setup using tools like MXToolbox, which scans TXT records in real time.

DMARC and SPF work together

It’s not enough to have SPF. Receiving servers also check for DMARC records. Without one—or if the DMARC policy is set to reject—many providers will block your emails, especially if SPF fails or is absent.

If your SPF record is correct but you still get the 550 5.1.3 error, check for common issues: overly long records (over 10 DNS lookups), multiple SPF records, or failing to include Mailgun’s sending IPs. You can test your configuration using RFC 7208, which defines the correct format.

Once your DNS records are set right, it can take up to 48 hours for propagation. You can verify it’s working using a real-time email verification tool like Email List Validation’s API to test if your domain is accepted for sending.

How DNS and SPF ensure valid email delivery in Mailgun

You can resolve a "Mailgun 550 5.1.3 domain unknown" error by verifying your domain’s DNS records and ensuring SPF is correctly configured. DNS directs mail servers to your domain’s IP address; if it’s missing or misconfigured, Mailgun won’t accept your messages. SPF then confirms whether your server is authorized to send on behalf of that domain. Without both, Mailgun rejects mail with a 5.1.3 error.

DNS: the foundation of email routing

DNS is the internet’s phonebook. When Mailgun receives a message, it queries DNS to find the IP address associated with your sending domain. If that record doesn’t exist or is misconfigured, Mailgun returns a "domain unknown" error.

For example, if your domain lacks an MX record or has a typo in the DNS entry, the mail server cannot reach your origin. This is a common reason for 550 5.1.3 errors in Mailgun integrations. You can verify DNS setup using tools like MXToolbox or DNS Survey.

SPF: authorizing senders at the domain level

SPF (Sender Policy Framework) acts as a whitelist for mail servers. It tells recipient servers, “Only these IP addresses or services are allowed to send email from my domain.” Mailgun checks this record before accepting any message.

If your SPF record doesn’t include Mailgun’s IP ranges, or if it’s too long or malformed, the message fails validation. This triggers a 550 5.1.3 error even if the domain exists in DNS.

SPF is defined in RFC 7208, the standard document that governs its implementation. Correct configuration here prevents sender reputation damage and ensures consistent deliverability.

Even if DNS resolves correctly, SPF errors still block delivery. Let’s say you’ve added Mailgun as a sending service but forgot to update SPF. Mailgun will reject the email, and the sender will face the 5.1.3 bounce. A simple fix: ensure your SPF record includes include:mailgun.org or include:mailgun.com.

To avoid these issues across large volumes, consider validating your email list for domain and sender authenticity before sending. Use bulk email list cleanup to catch invalid domains or missing DNS/SPF configurations early.

Check your domain's DNS and SPF records step by step

You're seeing a 550 5.1.3 "domain unknown" error when sending via HubSpot and Mailgun because your domain’s SPF record either doesn’t include mailgun.org or has a syntax issue. Fix it by verifying your DNS TXT record, ensuring it authorizes Mailgun’s servers, and confirming it follows SPF syntax rules. Let’s walk through it.

Access your DNS provider and locate the SPF record

Log into your domain’s DNS provider — Cloudflare, GoDaddy, AWS Route 53, or another platform. Look for a TXT record with a name field that typically matches your domain (e.g., @ or your domain name) and contains v=spf1. This is your SPF record.

Validate the SPF record configuration

  1. Check that the SPF record includes mailgun.org or the exact receiving domain used by your Mailgun account (e.g., mailgun.org or mg.yourdomain.com). Without it, Mailgun cannot validate your sending domain, and recipients will reject the email.
  2. Use a real-time DNS checker like MXToolbox’s DNS Lookup to view the current SPF record in effect. This shows what receivers see, not just what you think you set.
  3. Look for common syntax errors: extra spaces, duplicate v=spf1 entries, or incorrect modifiers. For example, v=spf1 ~all alone is not valid — it must be properly structured, such as v=spf1 include:mailgun.org ~all.
  4. Ensure there are no more than 10 DNS lookups in a single SPF record. Exceeding this limit (defined in RFC 7208) causes the record to fail silently.
  5. After editing, confirm the new record propagates by rechecking with MXToolbox or a similar tool. DNS changes can take up to 48 hours, though usually much faster.

Never update your TXT record without verifying the syntax first. Misconfigured SPF records can cause legitimate emails to be blocked. Use a domain-specific SPF validator to catch issues like missing or malformed includes.

For teams sending large volumes across HubSpot, Mailgun, and other platforms, ensuring correct SPF is part of a broader deliverability hygiene. Tools like bulk email list cleaning help avoid sending to invalid or risky addresses, reducing reputation risk and improving inbox placement.

Common SPF record mistakes that trigger 550 5.1.3 errors

When your HubSpot-to-Mailgun emails fail with a 550 5.1.3 "domain unknown" error, it’s often because your SPF record is misconfigured. You only get one SPF TXT record per domain, and mixing multiple records breaks validation. Your SPF must explicitly include Mailgun’s servers using include:mailgun.org, avoid outdated includes like spf.mandrillapp.com, and stay under the 10-DNS-lookup limit. Let’s break down the most common fixes.

Single SPF record only

  • You can only have one SPF TXT record per domain. Multiple SPF records aren’t supported and will be ignored or block your emails.
  • Combine all SPF mechanisms into one record using v=spf1 include:mailgun.org ~all — never split them across multiple TXT entries.
  • Use tools like MXToolbox’s SPF Solver to test your current setup and detect violations.

Correct Mailgun and mechanism inclusion

  • Never use deprecated includes like include:spf.mandrillapp.com. These are unrelated to Mailgun and cause validation failure.
  • Ensure your SPF record includes Mailgun’s IP range via include:mailgun.org. This is mandatory for Mailgun’s inbound and outbound validation.
  • Each include counts as a DNS lookup. Overdoing includes — especially include:spf.google.com and include:sendgrid.net together — can exceed Mailgun's or your DNS provider’s 10-lookup limit.
  • Use RFC 7208 as a reference for lookup limits and mechanism behavior.

If you're still getting 550 errors after fixing SPF, check your domain's DNS propagation and ensure the record is visible to external mail servers. You can verify this with DMARCian’s DNS lookup tool. If you're unsure whether your domain is properly set up, you can run a full list validation to test email deliverability at scale. Clean your email list with bulk verification and catch issues before sending.

Use real-time DNS and SPF checks to prevent 550 5.1.3 issues

You can avoid Mailgun’s 550 5.1.3 “domain unknown” error by confirming your domain resolves publicly with correct DNS records and by validating SPF syntax and compliance in real time. Static tools miss active server behavior—only live checks against actual mail servers expose misconfigurations that break delivery.

DNS records must be actionable, not just present

Just having an MX or A record isn’t enough. If your domain doesn’t resolve publicly via DNS, Mailgun will reject outbound messages. The record must be authoritative, publicly accessible, and correctly pointing to your mail server or provider’s infrastructure.

For example, if your A record points to an IP that’s not whitelisted in Mailgun’s system, or if your MX record is missing, the server sees your domain as unknown. Use tools that query DNS in real time from multiple global locations to ensure consistency.

SPF must pass both syntax and intent checks

SPF syntax errors—like missing quotes, repeated mechanisms, or malformed include directives—can silently break email delivery. Even valid syntax fails if it doesn’t align with RFC 7208, especially when using multiple includes or overly restrictive mechanisms.

Many static validators only flag obvious errors. Real-time checks simulate how Mailgun (or any receiving server) processes SPF during message acceptance. This reveals failures that static tools miss, such as oversized policy records or unresolved includes.

Mailgun's own test email service is one of the most reliable ways to confirm your domain is accepted. Send a test message from your verified Mailgun account to a valid inbox. If it fails with "550 5.1.3 domain unknown," the issue is in your DNS or SPF setup—not in Mailgun itself.

For real-time validation, tools like bulk email list cleaning can verify thousands of addresses with live DNS and SPF validation before sending. This catches dead domains and misconfigured domains before they trigger bounces or blacklists.

Even the most correct DNS and SPF setup fails if you don’t validate against active servers. Static checks only tell you what’s “supposed” to work. Real-time checks—especially those simulating Mailgun’s behavior—tell you what actually does.

How Email List Validation helps prevent 550 5.1.3 errors before they happen

You can stop 550 5.1.3 "domain unknown" errors before they hit your inbox by validating your email list in bulk or in real time. These errors happen when the recipient’s domain doesn’t exist, has broken DNS, or misconfigured SPF records. Email List Validation checks for these issues proactively, filtering out invalid domains before you send, which reduces bounces and protects your sender reputation.

Preventing delivery failures with DNS and SPF checks

When you send emails, your server checks the recipient’s domain DNS records. If those records are missing or misconfigured, the mail server responds with a 550 error—often with the code 5.1.3. That’s where email list validation comes in. Our bulk verification tool scans every domain in your list to confirm it exists and has properly configured MX and A records.

It also flags domains with broken SPF policies. SPF, which stands for Sender Policy Framework, tells mail servers which IPs are allowed to send on behalf of a domain. If SPF is missing, malformed, or overly strict, mail delivery fails. By catching these red flags early—before you send—Email List Validation prevents your messages from being blocked at the gate.

Let’s say your list includes an old domain that was decommissioned last year. Without validation, your mail server will try to deliver to that domain and fail with a 550 error. That increases your bounce rate and harms your reputation. With validation, that domain gets flagged as “invalid” and removed before a single email leaves your system.

Real-time checks stop bad sends before they start

If you’re using the real-time verification API, you’re checking every new email address as it’s added to your CRM or email tool. You’re not waiting until the next campaign. If a new contact signs up with an email on a domain with a broken SPF record or no DNS, the API blocks the submission with a clear status: “invalid,” “catch-all,” or “risky.”

This means you never send to a domain that’s already failing at the infrastructure level. That’s a powerful defense against bounce storms, reputation loss, and accidental spam trap exposure. It works with tools like HubSpot and Mailgun by cleaning the list before it ever hits them. You’ll see fewer soft bounces, fewer hard bounces, and better inbox placement over time.

For a deeper test, you can run inbox placement reports to see how your messages are landing across providers—Google, Outlook, Yahoo—and confirm whether your domain reputation is holding up. You can check the full suite of tools at bulk email list cleaning. It's a direct, no-drama fix to your sender health. The standard for email reliability is consistent DNS, valid SPF, and clean lists—and your list can meet that standard.

Verify domains and SPF settings in your email list before sending

Before sending to HubSpot or Mailgun, run every email through a verification tool that checks DNS and SPF alignment. This prevents 550 5.1.3 errors caused by invalid domains, catch-all setups, or misconfigured SPF records. You’re not just cleaning bounces—you’re fixing deliverability at the source.

Pre-check your list with real-time verification

  • Use the Email List Validation API to validate every address in your list before sending to HubSpot or Mailgun.
  • Filter out emails with a verdict of invalid, catch-all, or risky—these are high-risk for bounce and spam filtering.
  • Focus on domains that are valid but suspicious: poor DNS records, missing or weak SPF, or inconsistent DKIM alignment.
  • Check SPF records on domains with high-value contacts—especially those in sales or customer-facing campaigns—using tools like MXToolbox or RFC 7208 to confirm proper configuration.

Track real improvements in deliverability

  • After cleaning your list, run an inbox placement test to confirm higher deliverability to major providers like Gmail, Outlook, and Yahoo.
  • Monitor your sender reputation—clean lists reduce spam complaints and bounces, both of which hurt your reputation score over time.
  • Even a small reduction in invalid domains (e.g., 5% down to 1%) can meaningfully improve inbox placement and reduce 550 errors in Mailgun or HubSpot.
  • Use your verified list as a benchmark: future campaigns with the same list show stable performance if SPF and DNS remain consistent.

A real-world fix: How one team resolved 550 5.1.3 after Mailgun migration

After migrating to Mailgun, a sales team saw a 40% bounce rate on HubSpot campaigns due to 550 5.1.3 “domain unknown” errors. They used Email List Validation to scan their list, found 14 domains with no SPF or broken DNS, corrected the records, and removed 23 invalid addresses. Deliverability rose from 52% to 89% within a week.

Tracking down the root cause

The 550 5.1.3 error means the receiving server doesn’t recognize the sender’s domain — a clear DNS or authentication failure. After the Mailgun switch, they assumed it was a routing issue, but logs showed emails were rejected before reaching the server. Let’s be clear: this isn’t a Mailgun problem. It’s either the domain isn’t valid, SPF isn’t published, or the sending IP isn’t authorized. The RFC 5321 standard defines this error class, and it’s commonly triggered by missing or malformed SPF records [RFC 5321].

The team ran their entire HubSpot list through Email List Validation’s bulk verification. Within minutes, it flagged domains that either had no DNS records, had misconfigured SPF, or were outright invalid. They discovered a mix: some were typos (e.g., “gmaill.com”), others were outdated aliases, and 14 domains lacked any SPF policy. SPF checks are not optional — they’re required for deliverability with modern mail systems, even if not all servers enforce them strictly.

Fixing DNS and cleaning the list

For each of the 14 domains missing SPF, they reviewed their DNS zones and added valid SPF records. For example, one client’s domain had a blank TXT record with no policy, which caused Mailgun to reject the outbound message. They added include:spf.protection.outlook.com and ip4:203.0.113.0 to authorize sending. The change was simple but critical: SPF isn’t just for blocking spam — it’s a gatekeeper for inbox placement.

They also removed 23 entries flagged as invalid — not because they were fake, but because they pointed to domains with no MX or A records. These are dead ends. A single invalid address can degrade sender reputation, especially with high-volume tools like HubSpot and Mailgun. Once cleaned, the list was re-imported through HubSpot’s integration with Mailgun. Deliverability improved almost immediately, climbing from 52% to 89% over a 7-day period.

Real-time verification with Email List Validation’s API can prevent this issue before it happens, catching invalid domains or missing SPF during onboarding. For teams migrating email infrastructure, DNS health isn’t a footnote — it’s central to deliverability. A well-configured SPF record isn’t a luxury. It’s a requirement.

Keep sender reputation healthy by validating domains early

You can avoid 550 5.1.3 domain unknown errors—and protect your sender reputation—by validating domains before sending. Invalid or undeliverable domains pollute your sending metrics, increase bounce rates, and signal poor list hygiene. Checking DNS and SPF records early stops issues before they reach the inbox.

Why DNS and SPF checks matter for deliverability

Every time you send to a domain without proper DNS resolution or SPF configuration, you risk a hard bounce. These aren’t just technical errors—they’re red flags to email providers. Repeated failures, even from a single sender, can trigger rate limits or automated blacklisting.

Mailgun and HubSpot both enforce strict validation. If a domain lacks an MX record or SPF record, the server rejects your message with a 550 error. Left unchecked, these errors accumulate, and your IP reputation dips—especially if they're from domains known for abuse.

According to RFC 7208, SPF is a core part of email authentication. If a domain doesn’t publish a valid SPF record, sending is inherently risky. Proactively spotting missing or malformed SPF configurations reduces the chance of being flagged as spam.

How early validation improves inbox placement

High bounce rates and persistent 550 errors correlate strongly with low inbox placement. ISPs use these signals to assess sender trust. Even one poorly verified domain can distort your overall sending score.

Validating domains before sending lets you filter out risky addresses early—disposable domains, catch-all addresses, and domains with no active infrastructure. This reduces spam complaints, improves engagement rates, and keeps your sending IP clean.

Leading email providers like Gmail and Outlook treat consistent sender hygiene as a baseline requirement. A proactive check of DNS and SPF aligns with industry standards and helps maintain long-term deliverability. It’s not just about hitting the inbox—it’s about staying there.

Use tools that run real-time DNS and SPF checks during list validation. This includes domain-specific TTL checks and MX record verification. If you're managing large campaigns in HubSpot with Mailgun, cleaning your list ahead of time prevents 550 errors and maintains sender reputation. You can run full bulk verification with tools designed for accuracy and speed—no guesswork, no wasted sends.

Clean your entire list in under 10 minutes with automated DNS and SPF validation, and see how many addresses are technically undeliverable before any message is sent.

Conclusion: Prevent 550 5.1.3 errors with DNS and SPF validation

The 550 5.1.3 'domain unknown' error points to a misconfigured domain, not an invalid email address. It means the receiving mail server cannot verify the sender’s domain exists in DNS.

Even minor issues in DNS records or SPF setup can cause a complete campaign failure. These checks must be automated and baked into every email workflow, especially when using HubSpot with Mailgun.

Proactive tools like Email List Validation catch domain and envelope-level issues before they trigger bounces, protecting sender reputation and inbox placement. Regular verification is not optional—it’s essential.

Sources

  • HubSpot's list-health benchmarks show an average bounce rate of 2.48% and an average unsubscribe rate of 0.22% across industries. — HubSpot (2025)

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 550 5.1.3 mean in HubSpot Mailgun?

It means the receiving mail server cannot find the domain in DNS. The domain is not reachable or has no valid SPF records.

Can a valid email address cause a 550 5.1.3 error?

Yes, if the domain has misconfigured DNS or no SPF record, even a valid email will be rejected.

How do I check if my domain has correct SPF setup?

Use tools like MxToolbox or the Email List Validation API to verify SPF syntax and include statements.

How many SPF records can a domain have?

Only one SPF TXT record is allowed per domain; multiple records are invalid and will cause delivery failures.

Does Mailgun require SPF for all domains?

Yes. Mailgun uses SPF to verify that your domain authorizes it to send mail on your behalf.

Can I use Email List Validation to check SPF and DNS?

Yes. It performs real-time DNS and SPF checks as part of its email verification process.

Do SPF and DNS errors only affect Mailgun?

No. Any mail provider requiring sender authentication can reject emails with missing or invalid SPF/DNS.

What happens if I don’t fix the 550 5.1.3 error?

Emails will continue to bounce, harming sender reputation and blocking deliverability to valid recipients.

How often should I audit my domain’s SPF and DNS?

At least quarterly, and always after changing email providers or domains.

What’s the best tool for checking SPF and DNS before sending?

Email List Validation offers real-time verification, bulk checks, and inbox placement testing.