Setup guide

HubSpot: SPF, DKIM and DMARC

HubSpot authenticates a connected email sending domain with two DKIM CNAMEs, an SPF include and a DMARC record. On HubSpot's shared IPs the Return-Path stays on HubSpot's domain, so DMARC passes through DKIM.

By Ahmet Karaca · Updated October 13, 2026 · Checked against HubSpot documentation on October 13, 2026

DNS records to add

CNAMEHost<first DKIM host from HubSpot, like hs1-123456._domainkey>

<value from HubSpot, formatted like yourdomain-com.hs[#]a.dkim.hubspotemail.net>

DKIM key 1

CNAMEHost<second DKIM host from HubSpot>

<value from HubSpot, formatted like yourdomain-com.hs[#]b.dkim.hubspotemail.net>

DKIM key 2

TXTHost@

v=spf1 include:<include from HubSpot's Required data column> -all

Replace the part in angle brackets with your own value before publishing.

SPF on your From domain, which HubSpot highly recommends

TXTHost_dmarc

v=DMARC1; p=none; rua=mailto:<your report address>

Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.

DMARC policy, starting with HubSpot's neutral p=none

Steps

In HubSpot click the settings icon, go to Content → Domains & URLs, open the Email Sending tab and click Connect sending domain.
Enter an address you send marketing email from, confirm the sending domain, then sign in with your DNS provider or choose No, I'll set it up manually.
Copy each record's Host and Required data into your DNS provider: two DKIM CNAMEs, an SPF TXT and a DMARC TXT.
Wait at least 20 minutes, then check the Email Sending tab until the domain shows Authenticated.

Common mistakes

A domain that already hosts your website or other content can't be connected as an email sending domain. HubSpot recommends a separate subdomain such as news.example.com.
On Cloudflare, turn off domain-wide CNAME flattening and proxying for the sending domain before you connect it to HubSpot.
A record invalid error without a duplicated domain can mean your DNS provider rejected the CNAME over an underscore or a double hyphen. HubSpot says its DKIM records follow the protocol and to ask the provider's support for help.
If you already publish SPF, add HubSpot's include to that record and make sure v=spf1 and -all each appear only once.
Without a connected domain, HubSpot rewrites the From address onto a HubSpot-managed domain, for example user=yourcompany.com@hs-domain.com.

Good to know

Connecting a sending domain needs a Starter, Professional or Enterprise subscription of Marketing Hub, Sales Hub, Service Hub or Content Hub, plus Domain settings permissions.
The Return-Path can't be customized on HubSpot's shared network. With the Dedicated IP or Transactional Email add-on it moves to a subdomain of yours, such as 12345m.example.com, and SPF aligns too.
HubSpot advises relaxed alignment, adkim=r and aspf=r, in your DMARC record.

Frequently asked questions

Why does HubSpot show my domain as Partially authenticated?

DKIM is verified but SPF or DMARC isn't yet. The status changes to Authenticated once all three are verified.

How soon should I check HubSpot's Email Sending tab after publishing?

Wait at least 20 minutes. Records usually update in 10 to 70 minutes but can take up to 48 hours.

Does a sending subdomain need its own DMARC record in HubSpot?

No. HubSpot counts a subdomain as authenticated when the root domain has a DMARC record, because of DMARC policy inheritance.

Can one sending domain be connected to several HubSpot accounts?

Yes, at the same time. Each account can connect up to 2,000 email sending domains.

Can HubSpot Support set up my DMARC record?

No. HubSpot Support can't manage your DNS or choose a DMARC policy for you; that falls to your IT team or a DMARC service.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: HubSpot documentation.

Check your HubSpot setup

Or open the SPF checker, DKIM checker or DMARC checker directly.