Email authentication for HubSpot: SPF, DKIM and DMARC

22 June 2026 · 5 min read

To authenticate HubSpot email, connect your email sending domain in HubSpot and publish the records it generates: two DKIM CNAME records, an SPF include, a DMARC record and an MX record. Once the DKIM records verify, HubSpot signs your mail with your own domain, so DKIM aligns with your From address and DMARC can pass. That signature is what your DMARC policy depends on.

Where to connect the domain

In HubSpot, click the settings icon, then in the left sidebar go to Content > Domains & URLs, open the Email Sending tab and click Connect sending domain. HubSpot's guide, Manage your email authentication, walks through the wizard.

Connect the domain you actually use in From addresses. If your marketing mail comes from news@email.example.com, connect email.example.com.

The HubSpot records

<HubID> is your HubSpot account ID. Copy every host and value from your own HubSpot account rather than from this table.

DKIM: two CNAME records

HubSpot uses CNAME records for DKIM, so the keys stay on HubSpot's side and you never paste a public key. Publish both records exactly as given.

• Host names. Some DNS providers add your domain automatically. If you enter hs1-12345678._domainkey.example.com on one of those, the record becomes hs1-12345678._domainkey.example.com.example.com and never verifies. Enter just the part before your domain.
• Cloudflare. HubSpot says to turn off domain-wide CNAME flattening and the proxy for these records.
• Keep them as CNAMEs. Do not copy the key the CNAME currently resolves to into a TXT record. The CNAME is what lets HubSpot replace the key without you editing DNS.

Once the records resolve, HubSpot signs with d=example.com. Check a selector with the DKIM checker, entering the selector name (for example hs1-12345678) and your domain.

SPF: add HubSpot's include to your existing record

HubSpot's SPF value is specific to your account and takes this form:

include:<HubID>.spfNN.hubspotemail.net

HubSpot's own example of a merged record is:

v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all

• One SPF record only. If you already have one, for Google Workspace or Microsoft 365 for example, add HubSpot's include to it. HubSpot reminds you that v=spf1 and the all term should each appear only once. Two SPF records is a permanent error under RFC 7208.
• Ten DNS lookups at most. HubSpot's include adds to the total, alongside every other sender. The SPF checker counts them.

HubSpot's overview of email authentication explains that on its shared servers, HubSpot already has SPF configured for the envelope return path, the address bounces go to. Customers with a dedicated IP set up SPF on their own return path domain as part of the IP setup. On shared IPs, then, DKIM is the mechanism that aligns with your From domain.

DMARC

HubSpot needs a DMARC record before it marks the domain as fully authenticated. Its overview recommends relaxed alignment for both DKIM and SPF (adkim=r and aspf=r), which is also the default when you leave those tags out. A starting record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

If your domain already has a DMARC record, keep that one; do not add a second. Two records at _dmarc cancel each other out. HubSpot also notes that a subdomain counts as authenticated when a DMARC record exists at the root domain, because subdomains inherit it.

MX

HubSpot's connection includes an MX record. Its authentication overview adds that a "null MX" record (MX 0 .) should be removed from a sending domain, and that a domain used only for sending can be left without an MX record of its own. Follow what the wizard shows for your domain.

Verifying the connection

HubSpot says DNS changes usually take 10 to 70 minutes, but can take up to 48 hours, and suggests waiting at least 20 minutes before clicking verify. The status reads Partially authenticated when DKIM is verified but SPF or DMARC still need work, and Authenticated when all three are verified.

To confirm alignment on a real message, send yourself a HubSpot email and read the Authentication-Results header. You want dkim=pass with header.d= (or header.i=) on your domain, and dmarc=pass. The email header analyser lays these fields out.

From p=none to enforcement

1. Leave p=none running and read your aggregate reports in the DMARC report analyser. HubSpot's rows should show DKIM pass and aligned.
2. Fix every other legitimate sender too. DMARC applies to all mail from your domain, not just HubSpot's.
3. Move to p=quarantine, then p=reject. The current DMARC standard, RFC 9989, removed the old pct= tag; to trial a stricter policy, add t=y, which asks receivers to apply one level less.

Common HubSpot failures

• DMARC fails only on HubSpot mail. The DKIM CNAMEs are missing or mistyped, or the From address uses a different domain from the one you connected.
• HubSpot says connected, reports still show failures. Check the From domain of the failing emails against the connected domain, and give DNS time to update.
• SPF permanent error after adding HubSpot. Two SPF records, or more than ten lookups.
• SPF passes but does not align. On shared IPs the return path is HubSpot's. Aligned DKIM is what carries DMARC.

Run the DMARC checker to see your current policy. For the reasoning behind relying on DKIM, read DMARC alignment explained, and for the policy stages, p=none vs quarantine vs reject. If you would rather have the policy staged and the reports read for you, hosted DMARC does both.