Provider setup

HubSpot SPF, DKIM and DMARC: connecting an email sending domain

The DNS records HubSpot asks for when you connect an email sending domain, where its hubspotemail.net SPF include goes, and how DKIM and DMARC verify.

By Updated Last verified

On this page
  1. What connecting a sending domain covers
  2. The records HubSpot generates
  3. Do you add HubSpot to your root SPF record?
  4. DKIM: two CNAMEs that point to hubspotemail.net
  5. DMARC for a HubSpot sending domain
  6. Verify the connection
  7. MX: leave it unset rather than null
  8. Check your domain
  9. Sources

Usually yes, but on the domain in your From address, which is not always your root. When you connect an email sending domain, HubSpot's email authentication guide (opens in a new tab) generates two DKIM CNAME records plus one TXT record each for SPF and DMARC. If HubSpot prompts you to update SPF and the domain already has an SPF record, you add HubSpot's value, an include such as include:123456.spf03.hubspotemail.net, to that record instead of creating a second one. HubSpot's overview of email authentication (opens in a new tab) recommends adding HubSpot's SPF record to your From address domain. In HubSpot's email sending guide (opens in a new tab), most shared senders send from the root, as @example.com, so for them the include goes into the root SPF record. HubSpot's recommended path for shared senders is a subdomain such as @news.example.com, and then the record to edit is the subdomain's.

What connecting a sending domain covers

HubSpot's guide to email sending (opens in a new tab) requires a Starter subscription to connect an email sending domain, and HubSpot's email authentication guide (opens in a new tab) lists the feature on Marketing Hub, Sales Hub, Service Hub and Content Hub at Starter, Professional and Enterprise.

Email sending domains are used only for marketing and transactional emails. One-to-one emails from the contact record, the sequences tool and the conversations inbox go out over the network of the inbox you connected; they do not use HubSpot's email sending network or the email sending domain. The exception is a HubSpot-hosted inbox, which you can set up for the conversations inbox if you cannot connect your own: its sends go through HubSpot's email sending network. It cannot be used for one-to-one emails from contact records.

Why connect at all: HubSpot's overview (opens in a new tab) notes that DKIM, SPF and DMARC are not strictly required to send through HubSpot, but you cannot send with your domain in the From address until you connect that domain by setting up DKIM. Marketing and transactional emails sent without a connected email sending domain get a variable domain managed by HubSpot instead.

Before you start, per the authentication guide:

  • You need Domain settings permissions and a login for your DNS provider.
  • The domain must not be in use for another purpose, such as hosting your website. A subdomain should match the domain in the From address you use for marketing emails; the root works as long as it does not host content.
  • On Cloudflare, turn off domain-wide CNAME flattening and proxy settings for the sending domain.

For shared senders, the email sending guide recommends a unique subdomain such as @news.example.com while the website stays on www.example.com, which prevents DNS conflicts.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

The records HubSpot generates

The steps in HubSpot's email authentication guide (opens in a new tab):

  1. Click the settings icon in the top navigation bar, go to Content > Domains & URLs and open the Email Sending tab.
  2. Click Connect sending domain, enter an email address you use to send marketing emails and click Next. Check that the sending domain is correct and click Next again.
  3. Click Sign in with your DNS provider if HubSpot offers it, or choose No, I'll set it up manually.
  4. For each record, copy the Host and Required data values and paste them into your DNS provider.

For a sending domain of example.com, the set looks like this. The host and target shapes come from HubSpot's domain troubleshooting article (opens in a new tab); the numbers are placeholders, and your account shows its own values.

Purpose Type Host Value
DKIM CNAME hs1-123456._domainkey.example.com a target like example-com.hs1a.dkim.hubspotemail.net
DKIM CNAME the second host HubSpot shows a target like example-com.hs1b.dkim.hubspotemail.net
SPF TXT example.com your SPF record with include:123456.spf03.hubspotemail.net added
DMARC TXT _dmarc.example.com your DMARC policy

RFC 9989 (opens in a new tab) places the DMARC record for example.com at _dmarc.example.com.

Do you add HubSpot to your root SPF record?

HubSpot's overview of email authentication (opens in a new tab) separates two SPF jobs:

  • The envelope return path, the address bounces go to. HubSpot already has SPF configured there for marketing emails sent through its shared servers. Dedicated IP customers must configure SPF on their own return path domain during IP setup.
  • Your From address domain. HubSpot highly recommends adding its SPF record here, as a TXT record with the value from your HubSpot domain settings. That record provides a regularly updated list of the IP addresses HubSpot uses to send marketing emails from your From domain.

So you edit the root SPF record when the root is your From domain. For a subdomain such as news.example.com, the record belongs to that subdomain.

HubSpot's email authentication guide (opens in a new tab) sets the merge rule for a domain that already has SPF: add the Required data string after include: to the end of the existing record, and keep the SPF version and the -all flag to one each. For example, with one other provider already in the record:

v=spf1 include:_spf.example.com include:123456.spf03.hubspotemail.net -all

Never add a second SPF record beside the first. RFC 7208 (opens in a new tab) forbids a domain name from having multiple records that an authorization check would select. The SPF record generator gives the same advice: if you already have an SPF record, add the new services to it instead of creating a second record.

What the include costs: checked against live DNS, HubSpot's example name 123456.spf03.hubspotemail.net publishes an SPF record of 19 ip4 ranges ending in -all, with no further includes. Under RFC 7208 section 4.6.4 (opens in a new tab), include causes a DNS query while ip4 and all do not, and an evaluation is limited to 10 such terms; past that the result is permerror. So the HubSpot include uses one of your ten lookups. If your record is already close, see SPF too many DNS lookups.

DKIM: two CNAMEs that point to hubspotemail.net

HubSpot's overview (opens in a new tab) sets DKIM up with two CNAME records in your DNS provider. Once HubSpot and your DNS provider have verified them, the DKIM signature in the headers of your sent emails correlates to those CNAME entries.

HubSpot's domain troubleshooting article (opens in a new tab) uses hs1-123456._domainkey as the example host and formats the targets as your domain with dashes under dkim.hubspotemail.net. Two problems it names:

  • Duplicated root domain. Some DNS providers add the root domain to CNAME records by default, so hs1-123456._domainkey.example.com propagates as hs1-123456._domainkey.example.com.example.com. Enter hs1-123456._domainkey without the domain.
  • Invalid characters. A provider may invalidate the CNAME because of an underscore or a double hyphen. HubSpot states its CNAME records strictly adhere to the DKIM protocol; contact your provider's support if the record is refused.

To see which selector a message was signed with, read the s= value in the DKIM-Signature header of a message you sent; DKIM selector explains how.

DMARC for a HubSpot sending domain

HubSpot's overview (opens in a new tab) explains the DMARC tags and advises setting adkim and aspf both to r, relaxed alignment. A policy of none collects feedback without impacting existing email flows, and rua receives an aggregate report of your domain's traffic. HubSpot Support cannot help with DMARC record setup; HubSpot points you to your IT administrator or whoever manages your DNS.

DMARC passes on alignment. RFC 9989 (opens in a new tab) requires the Author Domain (opens in a new tab), the domain in the From header, to share an Organizational Domain with an authenticated identifier (relaxed alignment) or to be identical to it. DMARC relies solely on SPF validation of the MAIL FROM identity, and any aligned DKIM identifier produces a DMARC pass. HubSpot's email sending guide (opens in a new tab) defines the return path domain as the domain of the email sending network, which may differ from your From address; senders on HubSpot's shared network cannot customize it, while the dedicated IP and transactional email add-ons can.

A starting record from the DMARC record generator, published at _dmarc.example.com as RFC 9989 (opens in a new tab) places it:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The generator starts at p=none with a reporting address, which changes nothing for delivery, and moves to quarantine, then reject, once your real senders pass SPF or DKIM. How to set up DMARC walks through that order; if reports show failures, DMARC fail covers fixing SPF and DKIM alignment.

Verify the connection

HubSpot's email authentication guide (opens in a new tab) puts DNS updates at 10 to 70 minutes, up to 48 hours in some cases, and recommends waiting at least 20 minutes before verifying. Each email sending domain then shows one of three statuses:

  • Not authenticated: none of the three methods is fully set up or verified yet.
  • Partially authenticated: DKIM is set up and verified, but SPF or DMARC still needs verifying.
  • Authenticated: DKIM, SPF and DMARC are all set up and verified.

A subdomain counts as authenticated when a DMARC record exists at the root domain, because of DMARC policy inheritance. For a record with an issue, Continue setup shows the values you still need to add.

When HubSpot cannot connect, HubSpot's domain troubleshooting article (opens in a new tab) names three error types: a typo, where your record differs from HubSpot's; a missing record; and a conflicting record on your domain host. If a Dig lookup does not return the values HubSpot shows, the records may have been updated incorrectly or may not be propagating correctly.

MX: leave it unset rather than null

HubSpot's email authentication guide (opens in a new tab) lists MX among the four DNS record types of the connection process. HubSpot's overview (opens in a new tab) explains that a null MX record (MX 0 .) tells receiving servers your domain accepts no email, and some inbox providers reject email sent from such domains. HubSpot recommends removing a null MX; if the sending domain only sends, leave the MX record unset instead.

Check your domain

The free SPF, DKIM and DMARC check reads the public DNS records of the domain you enter, with no account needed. For SPF it flags a missing record, a soft fail (~all) and a record close to or over the 10-lookup limit; for DMARC it flags a missing record, a policy of none, no reporting address and subdomains left at none; for MX it flags a null MX. It looks for DKIM keys under commonly used selectors; a key under a selector it does not try shows as not verified. A DNS finding shows how your domain is set up, not where a particular message landed.

Sources

Tools for this

Frequently asked questions

Does the HubSpot SPF include go on my root domain?

HubSpot recommends adding its SPF record to your From address domain. Dedicated IP customers must also configure SPF on their own return path domain. If the domain already has an SPF record, add the HubSpot include to it instead of creating a second record.

Does the email sending domain cover one-to-one sales emails?

No. HubSpot uses email sending domains only for marketing and transactional emails. One-to-one emails, sequences and the conversations inbox send through the inbox you connected.

Which HubSpot subscriptions can connect an email sending domain?

A Starter subscription is required. HubSpot lists the feature on Marketing Hub, Sales Hub, Service Hub and Content Hub at Starter, Professional and Enterprise.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account