HubSpot SPF and DKIM setup

What you are setting up

HubSpot sends your marketing email from its servers. Connecting an email sending domain sets up three records, but understand the roles: the two DKIM records are the ones that make DMARC pass, by signing your mail with your domain. HubSpot also gives you an SPF record, but that SPF authenticates HubSpot's shared return-path, not your from address, so it does not align. DKIM is the load-bearing leg. And there is a hard rule worth knowing first: until the domain is connected, HubSpot rewrites the From address to a HubSpot-hosted system domain, so your mail does not go out as you at all.

Connect the sending domain

Go to Settings > Content > Domains & URLs > Email Sending and click Connect sending domain (you can connect your root domain or a subdomain; HubSpot requires a Starter subscription or higher). HubSpot generates the records and shows you the exact values for your account:

Type:  CNAME   (DKIM 1)
Host:  (the _domainkey name HubSpot shows you)
Value: (copy the exact target HubSpot shows)

Type:  CNAME   (DKIM 2)
Host:  (the _domainkey name HubSpot shows you)
Value: (copy the exact target HubSpot shows)

Type:  TXT     (SPF)
Host:  @          (or merge into your existing SPF record)
Value: v=spf1 ... include:<the hubspotemail.net include HubSpot shows> ... -all

Copy the values exactly as HubSpot shows them. The DKIM hosts and targets are generated for your account, so a guide that hardcodes them would be wrong. If you already publish an SPF record, merge HubSpot's include into it rather than adding a second SPF record (having two SPF records is itself a failure), and mind the ten-lookup limit. Our SPF builder handles the merge. HubSpot says DNS changes usually show up in 10 to 70 minutes, up to 48 hours in some cases, and asks you to wait at least 20 minutes before checking the status.

Add DMARC

Publish a standard _dmarc TXT record. HubSpot needs alignment to stay relaxed (the DNS default), so do not set adkim=s or aspf=s. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

If you connected a subdomain, it inherits your root domain's DMARC record. Build the record with our DMARC builder and progress past p=none once reports are clean.

The HubSpot gotcha

The rule that surprises people: HubSpot will not send email with your domain in the from address until the sending domain is connected via DKIM; it rewrites the From to a HubSpot-hosted system domain so the send still goes out. If your campaigns are going out from a HubSpot address instead of yours, this is why. Connect the domain first. The other classic break is the DNS host appending your root domain to the CNAME, turning <selector>._domainkey.yourdomain.com into <selector>._domainkey.yourdomain.com.yourdomain.com. Enter only the host portion and let your provider append the domain.

HubSpot shows a three-state status: Not authenticated, Partially authenticated (DKIM verified but SPF or DMARC not yet), and Authenticated (all three). Aim for the last one.

Confirm it worked

• Verify in HubSpot. The Email Sending page should read Authenticated once all the records resolve.
• Send a test and read the headers. Send a marketing email to an address you can inspect, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. HubSpot should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.