Set up SPF, DKIM and DMARC for HubSpot

Records at a glance

HubSpot’s setup screen lists every record your domain needs, and its documentation mentions MX records as part of the process too. Add exactly what the screen shows; the table above is the shape, not your values.

Set up SPF for HubSpot

HubSpot asks you to add its SPF include to your From domain, and the domain only shows as Authenticated once SPF, DKIM and DMARC all verify. Add the value from the Required data column after include: in your existing record. Don’t create a second SPF record, and keep one v=spf1 and one all at the end:

v=spf1 include:_spf.google.com include:<Hub ID>.spf03.hubspotemail.net -all

Older accounts may have been told to use include:shared.hubspot.com. Use whatever your current setup screen shows. Each include costs DNS lookups toward the limit of 10. With DMARC Dojo’s hosted SPF, you add HubSpot as a sender in the dashboard instead of editing this record, and changes that would pass the limit are refused.

Set up DKIM in HubSpot

1. Click the settings icon in the top navigation bar, then go to Content > Domains & URLs in the left sidebar and open the Email Sending tab.
2. Click Connect sending domain, enter an address you send marketing email from, click Next, and confirm the domain.
3. Use Sign in with [provider] if HubSpot offers it for your DNS host, or choose No, I’ll set it up manually.
4. For each record, copy the Host and Required data values into your DNS host. The two DKIM records are CNAMEs, so HubSpot hosts the keys and can rotate them.
5. Wait at least 20 minutes (usually 10 to 70, up to 48 hours), then check the status on the same tab: Partially authenticated means DKIM works but SPF or DMARC is still missing.

You need domain settings permission. HubSpot recommends a sending domain that isn’t used to host a website; a subdomain like info.example.com works, and it should match the domain in your From address.

Make it pass DMARC (alignment)

• DKIM aligns once the domain is connected. HubSpot signs with your domain, so the signature matches your From address. Until then, HubSpot won’t send with your domain in the From address at all: it rewrites it to a HubSpot-managed domain (for example user=yourcompany.com@hs-domain.com).
• SPF doesn’t align on shared IPs. SPF is checked on the envelope return path, which HubSpot sets to its own domain on its shared servers. SPF passes there, but for HubSpot’s domain, not yours.
• Dedicated IP customers configure SPF on their own return-path domain during IP setup, so their SPF can align too.

For most accounts, DKIM is what carries DMARC for HubSpot mail. That’s enough to pass, but it means a broken or missing DKIM record fails DMARC outright. See DMARC alignment for why.

Add DMARC

v=DMARC1; p=none; rua=mailto:<your report address>

If you connect a subdomain, HubSpot accepts a DMARC record on the root domain, since subdomains inherit it. DMARC Dojo recognizes HubSpot in DMARC reports, so you can see its volume and whether it passes with alignment next to your other senders before you enforce (moving from p=none to p=reject).

Troubleshooting

• Records show as missing. Many DNS hosts append the domain, turning hs1-123456._domainkey.example.com into hs1-123456._domainkey.example.com.example.com. Enter only hs1-123456._domainkey.
• The DNS host rejects the CNAME. Some hosts refuse underscores in names. HubSpot’s records follow the DKIM standard, so ask your DNS host to add them.
• Cloudflare breaks verification. HubSpot asks you to turn off proxying and domain-wide CNAME flattening for the sending domain’s records.
• Two SPF records. Adding HubSpot as a new v=spf1 record instead of merging it makes SPF return a permanent error for every sender.
• Stuck on Partially authenticated. DKIM is fine, but SPF or DMARC isn’t found yet. Check the root domain’s DMARC record exists and that the SPF include matches exactly.