HubSpot: SPF, DKIM and DMARC setup

This guide follows HubSpot's own knowledge base, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and HubSpot's current knowledge base page win.

This guide covers only connecting the domain you send marketing email from. For the protocols themselves, see SPF and DMARC.

Before you start

• You need access to your domain's DNS settings, usually at your registrar or hosting provider.
• Send from a domain you own. HubSpot's knowledge base says: "You will need to own and have access to each domain." It also notes you "can only authenticate an email sending domain that's not currently in use for another purpose, such as hosting your website"; a subdomain such as info.domain.com can be used instead (Manage your email authentication).
• If you use Cloudflare for DNS, HubSpot asks that "domain-wide CNAME flattening and proxy settings are turned off".

What HubSpot asks you to publish

HubSpot: "DKIM requires two CNAME records, while SPF records and DMARC each require a TXT record." (Manage your email authentication)

HubSpot's intro mentions MX among the record types ("four separate DNS record types: MX, DKIM, SPF, and DMARC"), but its setup steps list no MX record.

Step 1 — Start connecting the sending domain

1. In your HubSpot account, click the settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Content > Domains & URLs.
3. Click the Email Sending tab.
4. In the top right, click Connect sending domain.

Source: Manage your email authentication.

Step 2 — Confirm the domain and choose a method

1. On the domain connection screen, enter an email address you use to send marketing emails, then click Next.
2. Verify that the email sending domain is correct, then click Next.
3. If available for your DNS provider, click Sign in with [provider], or click No, I'll set it up manually to add the DNS records yourself.

Source: Manage your email authentication.

Step 3 — Add the DKIM records

At your DNS provider, create the two CNAME records HubSpot shows. For each record, click Copy next to the value in the Host and Required data columns, then paste the values in your DNS provider.

Source: Manage your email authentication.

Step 4 — Add the SPF record

Create the TXT record HubSpot shows, copying Host and Required data the same way. If you already have an SPF record, HubSpot says to add HubSpot to it "rather than creating a new one":

1. Add the string in the Required data column after include: to the end of the existing SPF record.
2. Check that the SPF version and the -all flag appear only once. HubSpot's example: v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all.

Source: Manage your email authentication.

Step 5 — Add the DMARC record

Create the TXT record HubSpot shows for DMARC, copying Host and Required data the same way.

If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.

HubSpot notes that "a subdomain will be considered authenticated if there's a DMARC record configured at the root domain level, due to DMARC policy inheritance."

Source: Manage your email authentication.

Step 6 — Wait for verification and check the status

"DNS records usually take between 10 and 70 minutes to update, but can take as long as 48 hours in some cases." HubSpot recommends waiting at least 20 minutes before checking. In Content > Domains & URLs, Email Sending tab, each domain shows one of three statuses:

• Not authenticated: none of the three methods has been fully set up or verified yet.
• Partially authenticated: DKIM is set up and verified, but SPF or DMARC still needs to be verified.
• Authenticated: DKIM, SPF and DMARC are all set up and verified.

If a record has an issue, click Continue setup to review the values to add at your DNS provider.

Source: Manage your email authentication.

SPF

HubSpot's help gives an SPF step (Step 4) for your From address domain. It also explains that SPF "is traditionally required for the envelope return path domain" and that "HubSpot already has this configured for marketing emails sent through its shared servers"; dedicated IP customers must configure SPF on their return path domain as part of their IP setup (Overview of email authentication). If a domain publishes more than one SPF record, SPF evaluation returns a permerror; see SPF.

How alignment works here

DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you connected. See DMARC for how alignment is evaluated.

Check your setup

Once HubSpot shows Authenticated, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.

The check looks for DKIM under a fixed list of common selectors, so it may not find your HubSpot DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For HubSpot, it is the start of the Host of each DKIM CNAME record HubSpot shows; check each of the two.