How to set up DMARC/DKIM/SPF for Hubspot
Published 28 Jun 2026
Updated 29 Oct 2026
13 min read
Summarize with
Updated on 29 Oct 2026: We clarified HubSpot SPF alignment and subdomain DNS setup, added domain-change steps, and qualified DMARC enforcement advice for forwarding and mailing lists.
HubSpot email authentication uses a connected sending domain, two DKIM CNAME records, an SPF TXT record, and a DMARC TXT record, plus a review of MX records. DKIM is the normal DMARC pass path on HubSpot's default shared sending because the HubSpot-controlled return-path does not match the visible From domain for SPF.
HubSpot's authentication guide covers DKIM, SPF, DMARC, and MX. The practical target is simple: HubSpot marks the sending domain authenticated, a real message passes DMARC through DKIM, and aggregate reports confirm legitimate HubSpot traffic before any policy change.
These steps cover marketing and transactional email sent through HubSpot's email network. One-to-one messages and other mail sent through a connected inbox use that inbox provider's authentication instead.
- Use a sending subdomain: Use a subdomain such as news.example.com or email.example.com to separate marketing traffic and authentication settings from corporate mail. Receivers still associate subdomains with the parent domain, so reputation is not fully isolated.
- Connect it in HubSpot: Add the domain in the Email Sending tab and copy the records HubSpot gives you, rather than guessing record names.
- Understand SPF alignment: On default shared sending, DMARC normally passes through DKIM. Eligible accounts that add and verify a custom return-path can also gain SPF alignment.
- Monitor before enforcement: If DMARC is new, start at p=none and review real traffic before choosing quarantine or reject for your sending domain.
Connect your sending domain in HubSpot
Add the domain inside HubSpot before touching DNS. You need Domain settings permissions in HubSpot and access to your DNS provider. HubSpot generates account-specific values, so copy them rather than using a generic SPF include or guessing DKIM selectors.
- Open settings: In HubSpot, go to Settings, then Content, then Domains & URLs.
- Choose Email Sending: Open the Email Sending tab and click Connect sending domain.
- Enter the From address: Use the exact address you send marketing mail from, such as newsletter@news.example.com when connecting news.example.com.
- Confirm the domain: Check that HubSpot selected the intended sending domain or subdomain before you continue.
- Pick manual DNS: Choose No, I'll set it up manually to copy each record, or use Sign in with [provider] if HubSpot supports your DNS provider.
HubSpot Email Sending tab with the Connect sending domain flow open.
Before you publish DNS
- Own the DNS zone: You need access to the DNS provider for the domain or subdomain you are authenticating.
- Avoid web host conflicts: Do not use a subdomain that already hosts a website or another mail system.
- Disable DNS proxying: If your DNS provider proxies records, keep the HubSpot CNAME records DNS-only.
- Match the sender: The sending subdomain should match the domain used in the visible From address.
Set up SPF
SPF checks the envelope MAIL FROM domain, shown as the Return-Path in a delivered message. HubSpot shared sending uses a HubSpot-controlled return-path, so adding its SPF include to your visible From domain does not change SPF alignment. Publish the SPF value shown in your account and use aligned DKIM as the normal DMARC pass path.
HubSpot's authentication overview says shared-server marketing email already has SPF configured for the envelope return-path, while dedicated IP customers must configure SPF as part of the IP setup.
HubSpot also documents a custom return-path beta for Marketing Hub Enterprise. If Add return-path domain appears in the Actions menu, use an unused subdomain and publish the records HubSpot supplies. Until verification finishes, HubSpot keeps the default return-path. With aspf=s, the return-path domain must exactly match the visible From domain; sharing only a parent domain is insufficient.
- Find your SPF value: Copy the SPF host and required data from the HubSpot domain setup screen.
- Update or create one TXT: If an SPF record exists at the supplied host, insert the HubSpot include before its final ~all or -all. If none exists, create one TXT record using the complete SPF value from your account.
- Keep one version tag: Keep v=spf1 once at the start and one all mechanism at the end. Preserve your existing ~all or -all policy unless you are intentionally changing it.
- Avoid hard-coded IPs: Use HubSpot's account-specific include instead of copying HubSpot IP addresses or CIDR ranges into the record.
- Check lookup count: SPF allows at most 10 DNS-querying mechanisms and modifiers during evaluation, including nested includes. Exceeding this limit causes permerror.
Illustrative SPF TXT record, replace the include valuesDNS
Type: TXT Host: @ Value: v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all
The @ host means the apex of the DNS zone you are editing. For news.example.com inside the example.com zone, the host is normally news. Use the exact Host value HubSpot supplies and account for any suffix your DNS provider appends. SPF does not inherit from the parent domain. Replace the sample include values, then check for duplicate records and lookup overflow.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Shared sending
- Return-path: HubSpot controls the bounce domain on the default shared setup.
- DMARC result: DKIM normally carries the domain match for your visible From domain.
- Expected reports: SPF alignment failures can appear while DMARC still passes through DKIM.
Dedicated IP or custom return-path
- Return-path: Use the dedicated IP setup or eligible custom return-path flow to create an aligned bounce domain.
- DNS source: Use the values in your HubSpot account because they are specific to the domain and account.
- Verification: Check HubSpot status and a real message header after DNS propagation.
Set up DKIM
DKIM is the most important HubSpot authentication step on default shared sending. HubSpot gives you two CNAME records, and receivers use those records to verify that HubSpot signed the message with your domain.
Without a connected sending domain, HubSpot can replace the From domain with a HubSpot-managed variable domain. Verify DKIM before launching a marketing campaign when the visible From domain must remain yours.
- Copy both CNAMEs: HubSpot gives two DKIM records with account-specific selector hosts under _domainkey.
- Publish exactly: Do not shorten, reformat, or merge the two CNAME values.
- Use DNS-only records: CNAME proxying or domain-wide CNAME flattening can break DKIM lookup behavior.
- Verify in HubSpot: Return to the Email Sending tab and let HubSpot check both records.
HubSpot DNS record table showing two DKIM CNAME records.
Illustrative DKIM CNAME patternDNS
Type: CNAME Host: hs1-ACCOUNTID._domainkey Value: copy the first HubSpot DKIM target Type: CNAME Host: hs2-ACCOUNTID._domainkey Value: copy the second HubSpot DKIM target
What a good DKIM result looks like
- Signature domain: The DKIM d= domain must match the visible From domain under your DMARC policy. Relaxed mode permits a shared organizational domain; adkim=s requires an exact match.
- Selector lookup: The selector resolves through the CNAME HubSpot provided.
- Message result: The message header shows DKIM pass and DMARC pass through DKIM.
- Failure pattern: If HubSpot says DKIM is missing, check for CNAME flattening, proxying, and host-name duplication.
Check MX before sending
MX is not a DMARC alignment method, but HubSpot recommends reviewing it for custom sending domains and subdomains. A null MX record, configured as MX 0 . declares that the domain accepts no mail, and some receivers reject outbound messages that use it.
- Check the sending domain: Inspect MX at the exact domain used in the visible From address, including the subdomain when one is used.
- Remove null MX: Delete MX 0 . before sending HubSpot marketing email from that domain.
- Handle send-only domains: For a send-only subdomain, HubSpot recommends leaving MX unset rather than publishing null MX. Use a monitored Reply-To address; missing MX records do not guarantee that the domain cannot receive mail.
- Protect existing inbound mail: Do not replace working corporate MX records with a generic value. Use only account-specific MX records that HubSpot supplies for a relevant setup.
MX and return-path conflicts
A custom return-path subdomain cannot already have MX or CNAME records for another mail provider. Choose an unused subdomain and confirm the exact records in HubSpot before publishing them.
Set up DMARC
Publish DMARC at the organizational domain unless your sending subdomain needs its own policy. HubSpot treats a subdomain as covered when the root DMARC policy applies through inheritance. If you are starting fresh, use p=none with reporting first. If p=quarantine or p=reject already works, keep that stronger policy and verify HubSpot DKIM instead of weakening the record.
A DMARC generator helps build the record. Replace dmarc@example.com in the example with a working report destination. For Suped monitoring, use the rua address supplied by Suped and complete any required authorization for reports sent to an external domain.
Starter DMARC TXT recordDNS
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc@example.com # Host is relative to the DNS zone. # Root policy: _dmarc.example.com # Separate policy for news.example.com: _dmarc.news.example.com
- Publish one record: Publish one DMARC TXT record at the selected host. A record at _dmarc.news.example.com overrides an inherited parent policy for mail using news.example.com; without it, check the parent policy, including sp for subdomains.
- Use aggregate reports: The rua address receives XML aggregate reports showing sending IPs and authentication results. Use them to identify HubSpot traffic and calculate its DMARC pass rate.
- Leave ruf out: Failure reports can contain sensitive message data and are not needed for normal HubSpot setup.
- Keep relaxed alignment: Default relaxed DMARC alignment works with an organizational-domain match and is suitable for most subdomain-based HubSpot sending.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
How HubSpot should appear in DMARC
- DKIM pass: HubSpot messages should pass DKIM with your sending domain.
- SPF exception: SPF alignment failures are acceptable when DKIM passes for the same visible From domain.
- Policy status: At p=none, receivers report failures without a request to quarantine or reject them.
- Report timing: Allow roughly 24 to 48 hours after sending for initial aggregate reports. Reports depend on receiver participation and arrive in batches, not as live delivery receipts.
Verify HubSpot authentication and troubleshoot DNS
Verify HubSpot status, DNS lookup results, and a real message header. A green status in HubSpot is not enough until a sent message shows aligned DKIM and a DMARC pass.
- Wait before retrying: DNS often updates in 10 to 70 minutes, but some providers take 24 to 48 hours. Wait at least 20 minutes before the first verification check.
- Check HubSpot status: Authenticated means DKIM, SPF, and DMARC are verified in the Email Sending tab. Partially authenticated means DKIM is verified but SPF or DMARC still needs work. Click Continue setup to review missing values.
- Send a real email: Send a HubSpot marketing email to a mailbox you control and inspect Authentication-Results.
- Compare the domains: Look for dkim=pass and dmarc=pass in the receiver's Authentication-Results header. Compare header.d with header.from for DKIM, and smtp.mailfrom with header.from for SPF. SPF can pass authentication while its domain fails DMARC alignment.
- Use a checklist: Follow a verification checklist when multiple senders share the domain.
HubSpot Email Sending tab showing authenticated and partially authenticated domains.
Common failure
- Duplicate SPF: Two TXT records start with the SPF version at the same host.
- Wrong host: The DNS provider adds the root domain twice to a DKIM host.
- Flattened CNAME: The DNS provider rewrites the DKIM target instead of publishing a CNAME.
- Strict policy early: A new HubSpot source appears after p=reject is already active.
Direct fix
- Merge SPF: Keep one SPF TXT record and add the HubSpot include inside it.
- Trim host names: Enter only the host label if your DNS UI appends the domain.
- Use plain CNAME: Disable proxying and publish the exact HubSpot target.
- Hold the campaign: Stop the affected send until HubSpot DKIM passes. Do not weaken the domain-wide policy without reviewing other senders.
The fastest practical check is a live test email. Send one message through HubSpot and review the authentication result for SPF, DKIM, DMARC, header domains, and DNS findings.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
Monitor HubSpot authentication
HubSpot authentication is not a one-time task. DNS or account changes and newly added senders can break passing mail after launch. Suped's DMARC monitoring groups reports by sending source so you can review HubSpot failures alongside other approved senders.
- Watch HubSpot volume: Review HubSpot message counts and DMARC failures after campaigns or DNS changes.
- Separate known sources: Classify HubSpot apart from corporate mail, billing mail, and support mail.
- Detect spoofing: Investigate unknown sources claiming your domain before classifying authentication failures as unauthorized mail.
- Track reputation: Use blocklist (blacklist) monitoring alongside DMARC so deliverability issues are visible early.
Where Suped fits
Suped is our DMARC reporting and email authentication platform. Use it to distinguish HubSpot SPF alignment failures from DKIM failures, investigate affected sending sources, and review authentication results before changing DMARC policy.
Choose DMARC enforcement for your sending domain
Consider p=reject for a dedicated HubSpot sending subdomain after every approved sender passes consistently. RFC 9989 advises against p=reject for general-purpose domains whose users post to Internet mailing lists, because indirect mail flows can fail DMARC. Review that traffic before changing the parent domain. Suped's Hosted DMARC controls let teams change policy without editing DNS each time.
- Stabilize p=none: Collect enough aggregate reports to identify HubSpot and every real sender.
- Fix HubSpot first: Do not enforce while HubSpot DKIM is missing, intermittent, or signed by the wrong domain.
- Move to quarantine: Use quarantine as a controlled step when legitimate mail is passing consistently.
- Review failed sources: Investigate forwarding and mailing-list traffic as well as direct sends. Resolve legitimate failures before requesting stricter handling.
- Choose reject when appropriate: For a dedicated sending domain, use p=reject after checking indirect mail flows and confirming that legitimate sources have a passing path.
Policy rollout gates
Use these gates when considering enforcement for a dedicated HubSpot sending domain. Receivers retain control of message handling.
Monitor
monitoring policy
Use p=none while mapping legitimate sources; receivers still apply their own filtering.
Constrain
request quarantine
Use quarantine after HubSpot DKIM and other senders are stable.
Reject
request rejection
Request rejection of DMARC failures after reviewing direct and indirect mail flows.
Before p=reject
- Known sources: HubSpot and every approved sender appear in DMARC reports.
- Passing DKIM: HubSpot consistently passes through its aligned DKIM signature.
- Clean SPF: The domain has one valid SPF record with no lookup overflow.
After p=reject
- Active alerts: New HubSpot failures trigger alerts before campaign volume grows.
- Blocked abuse: Receivers get a request to reject DMARC failures, but still apply their own filtering and exceptions.
- Change control: New senders are reviewed before they send on the protected domain.
Change a HubSpot sending domain safely
Authenticate the new domain before moving campaigns or automated email. HubSpot's domain change recommendations include notifying subscribers and increasing volume gradually; passing DNS checks alone does not establish sender reputation.
- Verify the new domain: Complete DKIM, SPF, and DMARC setup, send a real message, and link the domain to your dedicated IP if you use one.
- Review existing sends: Check the From address in automated workflows and transactional email before switching, and confirm that replies reach a monitored inbox.
- Keep the change recognizable: Retain a familiar From name and notify subscribers about the new sending address.
- Warm up the domain: Begin with highly engaged subscribers and increase volume gradually. Review bounces, complaints, and DMARC results before expanding sends.
HubSpot SPF, DKIM, and DMARC FAQ
DKIM is required when HubSpot marketing email must keep your domain in the visible From address. SPF and DMARC are required for HubSpot's Authenticated status. Without a connected sending domain, HubSpot can send with a managed variable domain instead.
On default shared HubSpot sending, SPF normally passes for HubSpot's return-path domain, but that domain does not match your visible From domain for DMARC. DMARC still passes through aligned DKIM. Adding an SPF include to your From domain does not change the return-path; eligible accounts can configure a custom return-path instead.
No. One-to-one messages, sequences, and conversations inbox email normally use the network and authentication of the connected inbox. The HubSpot email sending domain applies to marketing and transactional email sent through HubSpot's network.
Copy the exact Required data value from your HubSpot Email Sending setup screen. HubSpot uses account-specific hosts such as 123456.spf03.hubspotemail.net. Replace the sample value rather than adding a guessed include, and keep only one SPF record at that host.
Start with p=none if DMARC is new on the domain. Keep quarantine or reject if the domain already uses that policy successfully, then verify HubSpot DKIM before sending large campaigns. Review forwarding and mailing-list use before applying reject to a domain also used for employee email.
DNS records often update in 10 to 70 minutes, but some providers take 24 to 48 hours. Wait at least 20 minutes before the first check, then review HubSpot status, DNS lookup results, and a live test email.
