# HubSpot: SPF, DKIM and DMARC setup > How to connect your email sending domain in HubSpot — start the connection, add the two DKIM CNAME records and the SPF and DMARC TXT records, and confirm the Authenticated status — with each step linked to HubSpot's current knowledge base. Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/hubspot This guide follows HubSpot's own knowledge base, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and HubSpot's current knowledge base page win. This guide covers only connecting the domain you send marketing email from. For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc). ## Before you start - You need access to your domain's DNS settings, usually at your registrar or hosting provider. - Send from a domain you own. HubSpot's knowledge base says: "You will need to own and have access to each domain." It also notes you "can only authenticate an email sending domain that's not currently in use for another purpose, such as hosting your website"; a subdomain such as `info.domain.com` can be used instead ([Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot)). - If you use Cloudflare for DNS, HubSpot asks that "domain-wide CNAME flattening and proxy settings are turned off". ## What HubSpot asks you to publish | Purpose | Record type | Count | Where the values come from | |---|---|---|---| | DKIM | `CNAME` | 2 | **Host** and **Required data** shown in HubSpot | | SPF | `TXT` | 1 | **Host** and **Required data** shown in HubSpot | | DMARC | `TXT` | 1 | **Host** and **Required data** shown in HubSpot | HubSpot: "DKIM requires two CNAME records, while SPF records and DMARC each require a TXT record." ([Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot)) HubSpot's intro mentions MX among the record types ("four separate DNS record types: MX, DKIM, SPF, and DMARC"), but its setup steps list no MX record. ## Step 1 — Start connecting the sending domain 1. In your HubSpot account, click the **settings** icon in the top navigation bar. 2. In the left sidebar menu, navigate to **Content > Domains & URLs**. 3. Click the **Email Sending** tab. 4. In the top right, click **Connect sending domain**. Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## Step 2 — Confirm the domain and choose a method 1. On the domain connection screen, enter an email address you use to send marketing emails, then click **Next**. 2. Verify that the email sending domain is correct, then click **Next**. 3. If available for your DNS provider, click **Sign in with [provider]**, or click **No, I'll set it up manually** to add the DNS records yourself. Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## Step 3 — Add the DKIM records At your DNS provider, create the two `CNAME` records HubSpot shows. For each record, click **Copy** next to the value in the **Host** and **Required data** columns, then paste the values in your DNS provider. Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## Step 4 — Add the SPF record Create the `TXT` record HubSpot shows, copying **Host** and **Required data** the same way. If you already have an SPF record, HubSpot says to add HubSpot to it "rather than creating a new one": 1. Add the string in the **Required data** column after `include:` to the end of the existing SPF record. 2. Check that the SPF version and the `-all` flag appear only once. HubSpot's example: `v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all`. Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## Step 5 — Add the DMARC record Create the `TXT` record HubSpot shows for DMARC, copying **Host** and **Required data** the same way. If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy. HubSpot notes that "a subdomain will be considered authenticated if there's a DMARC record configured at the root domain level, due to DMARC policy inheritance." Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## Step 6 — Wait for verification and check the status "DNS records usually take between 10 and 70 minutes to update, but can take as long as 48 hours in some cases." HubSpot recommends waiting at least 20 minutes before checking. In **Content > Domains & URLs**, **Email Sending** tab, each domain shows one of three statuses: - **Not authenticated**: none of the three methods has been fully set up or verified yet. - **Partially authenticated**: DKIM is set up and verified, but SPF or DMARC still needs to be verified. - **Authenticated**: DKIM, SPF and DMARC are all set up and verified. If a record has an issue, click **Continue setup** to review the values to add at your DNS provider. Source: [Manage your email authentication](https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot). ## SPF HubSpot's help gives an SPF step (Step 4) for your From address domain. It also explains that SPF "is traditionally required for the envelope return path domain" and that "HubSpot already has this configured for marketing emails sent through its shared servers"; dedicated IP customers must configure SPF on their return path domain as part of their IP setup ([Overview of email authentication](https://knowledge.hubspot.com/marketing-email/overview-of-email-authentication)). If a domain publishes more than one SPF record, SPF evaluation returns a permerror; see [SPF](https://emailmarketing.net/learn/authentication/spf). ## How alignment works here DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you connected. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated. ## Check your setup Once HubSpot shows **Authenticated**, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC. The check looks for DKIM under a fixed list of common selectors, so it may not find your HubSpot DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=`. The selector is the part of the DKIM record name before `._domainkey`. For HubSpot, it is the start of the **Host** of each DKIM CNAME record HubSpot shows; check each of the two.