emailsecops
Menu
Guides

HubSpot SPF, DKIM and DMARC setup

Connect your email sending domain in HubSpot: two DKIM CNAMEs (hs1 and hs2), an account-specific SPF include and a DMARC record, all shown in HubSpot's setup screen. DKIM aligns; SPF aligns only with a custom return-path or dedicated IP.

Marketing automation · reviewed October 13, 2026 against HubSpot's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your HubSpot account: copy it from HubSpot's setup screen, which shows the exact record.

ForTypeHostValue
SPF TXT {domain} v=spf1 include:{hub-id}.spf{nn}.hubspotemail.net -allMerge the include into your existing SPF record; HubSpot marks SPF as strongly recommended.
DKIM CNAME hs1-{hub-id}._domainkey.{domain} {domain-with-dashes}.hs{n}a.dkim.hubspotemail.netCopy the exact host and value from the Host and Required data columns in HubSpot.
DKIM CNAME hs2-{hub-id}._domainkey.{domain} {domain-with-dashes}.hs{n}b.dkim.hubspotemail.net
SPFCustom return-path (Marketing Hub Enterprise) optional TXT {return-path-subdomain}.{domain} v=spf1 include:{account-specific}.hubspotemail.net -allHubSpot suggests bounce, mail or return as the subdomain; copy the include from the setup dialog.
Bounces (MAIL FROM)Custom return-path (Marketing Hub Enterprise) optional MX {return-path-subdomain}.{domain} priority 10 · mx.hubapi.comCopy the priority from the setup dialog, which also lists two DKIM CNAMEs for this subdomain.
DMARC TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Needed for HubSpot's Authenticated status; a record on the root domain also covers a subdomain sending domain.

SPF

Add the account-specific include:{hub-id}.spf{nn}.hubspotemail.net to the SPF record of your email sending domain; HubSpot marks it strongly recommended and only shows the domain as Authenticated once DKIM, SPF and DMARC all verify. On HubSpot's shared network the return path is HubSpot's own domain, so this include doesn't make SPF align; that takes a custom return-path (Marketing Hub Enterprise) or a dedicated IP sending domain.

DKIM

Two CNAMEs, hs1-{hub-id}._domainkey and hs2-{hub-id}._domainkey, point to keys HubSpot hosts under dkim.hubspotemail.net; copy both from the Host and Required data columns. DKIM is the one record HubSpot needs before you can send with your own domain in the From address.

DMARC alignment

DKIM aligns: HubSpot signs with your sending domain through the hs1 and hs2 keys. SPF aligns only with a return-path subdomain of your domain (custom return-path or dedicated IP); HubSpot wants relaxed alignment (adkim=r; aspf=r) and flags strict values as incorrect.

Common mistakes

  • You can only authenticate a sending domain that isn't used for anything else, such as your website; HubSpot recommends a subdomain like news.example.com that matches the From address.
  • Without a connected domain, HubSpot rewrites the From address onto a HubSpot-managed domain.
  • On Cloudflare, turn off CNAME flattening and the proxy for the DKIM CNAMEs.
  • DNS hosts that append the zone produce hs1-123456._domainkey.example.com.example.com, so enter only hs1-123456._domainkey.
  • Remove a null MX (MX 0 .) from the sending domain: HubSpot says it can make some inbox providers reject the mail.
  • HubSpot's troubleshooting text mentions a smtpapi selector and include:shared.hubspot.com, which don't match the hs1/hs2 keys and hubspotemail.net include the setup generates, so use the values shown in the app.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises HubSpot

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • DKIM keys delegated (CNAME) to *.hubspotemail.net

Questions

What SPF record does HubSpot need?+
Add the account-specific include:{hub-id}.spf{nn}.hubspotemail.net to the SPF record of your email sending domain; HubSpot marks it strongly recommended and only shows the domain as Authenticated once DKIM, SPF and DMARC all verify. On HubSpot's shared network the return path is HubSpot's own domain, so this include doesn't make SPF align; that takes a custom return-path (Marketing Hub Enterprise) or a dedicated IP sending domain.
What are the DKIM records for HubSpot?+
Two CNAMEs, hs1-{hub-id}._domainkey and hs2-{hub-id}._domainkey, point to keys HubSpot hosts under dkim.hubspotemail.net; copy both from the Host and Required data columns. DKIM is the one record HubSpot needs before you can send with your own domain in the From address.
Does HubSpot mail pass DMARC?+
DKIM aligns: HubSpot signs with your sending domain through the hs1 and hs2 keys. SPF aligns only with a return-path subdomain of your domain (custom return-path or dedicated IP); HubSpot wants relaxed alignment (adkim=r; aspf=r) and flags strict values as incorrect.
Do I need a separate DMARC record for HubSpot?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources