HubSpot: set up SPF, DKIM and DMARC

To authenticate a domain for HubSpot email, connect your email sending domain in HubSpot and add the DNS records it generates — typically two DKIM CNAME records at hs1._domainkey.yourdomain.com and hs2._domainkey.yourdomain.com pointing at HubSpot-generated targets ending in .hubspotemail.net — then publish a DMARC record at _dmarc. HubSpot signs mail with your domain via those DKIM CNAMEs, which is what gives you DMARC alignment. The exact targets are unique to your HubSpot account, so copy them from the connect-domain screen rather than from any example.

Step 1 — Connect the sending domain (DKIM)

In HubSpot, go to Settings → Content → Domains & URLs → Email Sending Domain and start Connect a sending domain. HubSpot generates a set of CNAME records for you to add — usually two DKIM records shaped like this:

Host:  hs1._domainkey.yourdomain.com
Value: yourdomain.com.hs1.dkim.hubspotemail.net

Host:  hs2._domainkey.yourdomain.com
Value: yourdomain.com.hs2.dkim.hubspotemail.net

The real targets HubSpot shows contain an account-specific hash — use the values from your own connect-domain screen, not the placeholders above. Add each as a CNAME, then click Verify in HubSpot. These DKIM CNAMEs sign your mail with d=yourdomain.com, which is exactly what DMARC needs to align.

HubSpot's official instructions: Connect your email sending domain.

Step 2 — SPF

HubSpot authenticates via the DKIM CNAMEs above, so you do not need to rebuild your SPF record around HubSpot. Keep your existing SPF for the services that send as your domain and stay within the 10-lookup limit — if HubSpot's setup asks for an additional record, add exactly what it specifies and re-check the total with the SPF lookup counter.

Step 3 — DMARC

Publish a TXT record at host _dmarc:

Start at p=none, confirm from the aggregate reports that HubSpot mail is passing and aligned via DKIM, and only then move up to p=quarantine and p=reject. Validate the record and preview the next step in the DMARC record checker.

Where to add these records

The DKIM records are CNAME; the DMARC record is TXT. All go in your domain's DNS zone at your registrar or DNS host:

• Enter only the host prefix HubSpot shows (hs1._domainkey) — most panels append your domain.
• A CNAME's value must be a bare hostname with no http:// and no trailing slash.

DNS changes can take a few hours to propagate before HubSpot can verify the domain.

Verify it worked

HubSpot marks the sending domain connected once the CNAMEs resolve. Send a test email, open the raw headers, and confirm dkim=pass with d=yourdomain.com and dmarc=pass. To see DKIM presence and DMARC alignment in one place, run a scan of your domain below.