How to set up SPF, DKIM & DMARC for HubSpot

HubSpot authenticates marketing email through an "email sending domain" — two DKIM CNAME records whose targets embed your HubSpot account ID. HubSpot's connect wizard generates both.

DKIM CNAMEs

Hosts are always hs1-…._domainkey and hs2-…._domainkey with your account number; targets point at hubspotemail.net.

Type	`CNAME`
Host / Name	`hs1-1234567._domainkey`
Value / Content	`yourdomain-com.hs01a.dkim.hubspotemail.net` Example only — copy both host/target pairs from HubSpot → Settings → Content → Domains & URLs → Connect a domain → Email sending.

Type	`CNAME`
Host / Name	`hs2-1234567._domainkey`
Value / Content	`yourdomain-com.hs01b.dkim.hubspotemail.net` Example only — copy the exact pair from the same wizard.

HubSpot → Settings → Content → Domains & URLs → Connect a domain → Email sending.
Follow the wizard for your sending domain; publish the two CNAMEs it shows.
Click Verify. SMTP/transactional sends via HubSpot may show additional SPF guidance in the same screen — follow what your wizard lists.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers HubSpot and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: The email sending domain gives HubSpot marketing mail aligned DKIM. Without it, sends are signed by shared HubSpot domains and fail DMARC alignment.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from HubSpot to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is HubSpot's official docs.