Lookproof Browse tools

DMARC, SPF and DKIM for HubSpot

Updated 2026-11-06

This guide is for admins who send marketing or transactional email from HubSpot with their own domain and want it at p=reject. Every HubSpot value below comes from knowledge.hubspot.com, read in November 2026. Background: SPF, DKIM, DMARC.

What HubSpot sends from

HubSpot is a sending platform. Marketing and workflow email go out through HubSpot's own email sending network. One-to-one email, sequences and the conversations inbox go through the inbox you connected, such as Google or Outlook, and need that provider's records. A HubSpot-hosted inbox is the exception.

For marketing mail, three identities matter:

  • From address. HubSpot calls this the email sending domain. HubSpot recommends a subdomain such as news.example.com. It will not connect a domain "currently in use for another purpose, such as hosting your website", and says that "will produce an error". If the domain is not connected, HubSpot rewrites the From to a HubSpot managed domain, for example [email protected].
  • Envelope sender (return path). HubSpot defines the return path domain as "the domain of the email sending network". As of November 2026, the docs say it cannot be customized on the shared network without the Dedicated IP or Transactional Email Add-On. A newer article, updated 5 November 2026, adds a custom return-path subdomain for Marketing Hub Enterprise. With a dedicated IP, the return path is a "dedicated IP sending domain", shown in HubSpot's examples as 12345m.example.com.
  • DKIM signing domain. HubSpot signs with keys behind two CNAME records it generates for your sending domain. HubSpot does not state the d= value; the signature "correlates to the associated CNAME entries you configured".

SPF

HubSpot gives you the SPF value during setup. In HubSpot, go to Settings > Content > Domains & URLs > Email Sending, click Connect sending domain, and copy the value in the Required data column. As of November 2026, HubSpot shows a value with a number in it (123456 in its examples, a placeholder): include:123456.spf03.hubspotemail.net and include:123456.spf01.hubspotemail.net. The Troubleshoot section of the same setup article tells you to check for include:shared.hubspot.com. Use the value your account shows. If it is a full v=spf1 ... -all record and you already have SPF, copy only the include: term into your existing record. If you have no SPF yet, end the record in ~all.

Where the record goes depends on the return path:

  • Shared network, default return path. HubSpot says it already configured SPF on its own return path domain. It still "highly" recommends adding its include as a TXT record on the sending domain itself, using the Host HubSpot shows (@ in HubSpot's example, which is for a root-domain sender).
  • Dedicated IP. You publish an A record, an MX record, a TXT (SPF) record and CNAME (DKIM) records for the two domains HubSpot lists (the email sending domain and the dedicated IP sending domain), with the Host and Value HubSpot shows. The MX priority must be 0.
  • Custom return-path (Marketing Hub Enterprise). You add the DNS records HubSpot provides for the subdomain you choose, such as bounce, mail or return. The article lists no record types.

Only one SPF record is allowed per name. HubSpot says to add its include to the end of an existing record and keep the v=spf1 version and the all mechanism only once. HubSpot's own examples end in -all. We recommend ~all: RFC 9989 warns that some receivers check SPF early in the SMTP transaction, so -all can get mail rejected before DMARC is evaluated, even when aligned DKIM would have passed it. That mail never appears in your aggregate reports. A typical setup on example.com, where include:_spf.example.net stands for another service and 123456 is the HubSpot placeholder:

example.com TXT "v=spf1 include:_spf.example.net include:123456.spf03.hubspotemail.net ~all"

This record uses 2 DNS lookups by itself, one per include. The limit is 10 (RFC 7208). Each include also costs lookups inside its own record. HubSpot documents no fixed number for its include. When we counted it with real DNS on 7 November 2026, 123456.spf03.hubspotemail.net and 123456.spf01.hubspotemail.net held only IP ranges, so each cost 1 lookup in total, and include:shared.hubspot.com held one further include with only IP ranges, so it cost 2 in total. HubSpot can change these records, so count your own tree with the SPF lookup counter. HubSpot says to remove hard-coded HubSpot IP addresses. See SPF multiple records and too many SPF lookups.

DKIM

DKIM is what lets you send from your own domain. HubSpot uses two CNAME records. These are the steps as of November 2026:

  1. In HubSpot, click the settings icon, go to Content > Domains & URLs, and open the Email Sending tab.
  2. Click Connect sending domain, enter an address you send marketing email from, click Next, and confirm the domain.
  3. Sign in with your DNS provider if offered, or click No, I'll set it up manually.
  4. Copy the Host and Required data values for each record into your DNS provider.
  5. Check the status on the Email Sending tab.

The record below is combined from two examples on HubSpot's troubleshooting page, with its placeholders and trailing dot kept. Your host and target pair comes from your setup screen.

hs1-123456._domainkey.example.com CNAME yourdomain-com.hs[#]a.dkim.hubspotemail.net.

The second record points to a target ending in hs[#]b.dkim.hubspotemail.net. HubSpot shows no example host for it. HubSpot does not document key length or a way to choose it. The setup article's DKIM check uses the selector smtpapi, which does not match the hs1- format. Use the selector your setup screen shows.

DMARC alignment

DMARC passes when SPF or DKIM passes and the domain it checked aligns with the From domain. SPF alignment compares the RFC5321.MailFrom (return path) domain with the From domain. DKIM alignment compares the d= domain with the From domain. Relaxed alignment needs the same organisational domain. Strict needs an exact match. HubSpot recommends adkim=r and aspf=r.

For HubSpot mail from example.com:

  • Default shared network. The return path is, in our reading, a HubSpot domain (check the Return-Path header of a received message), so SPF does not align, even with HubSpot's include on example.com. DMARC rests on DKIM.
  • After DKIM setup. HubSpot does not state the d= value, so check the DKIM-Signature header of a received message. If d= is your sending domain, such as news.example.com, it aligns in relaxed mode with any From in example.com, and in strict mode only with a From in exactly that domain.
  • Custom return-path. HubSpot says this "will allow for SPF alignment". Under relaxed alignment, mail.example.com aligns with a From in example.com. Under aspf=s the return-path domain must equal the From domain exactly, so a separate bounce. subdomain does not align strictly.

HubSpot's glossary defines DKIM alignment as the From address and return path matching. In DMARC, DKIM alignment compares d= with the From domain; the return path plays no part.

Step by step to p=reject

  1. Publish SPF. Copy HubSpot's include from the Required data column and add it to the single TXT record on your sending domain, merging other senders and keeping a single ~all.
  2. Turn on DKIM. Publish both CNAME records HubSpot generates for the sending domain, wait for verification, and confirm the domain is no longer Not authenticated.
  3. Publish DMARC with p=none and rua. Add a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected] so receivers send aggregate reports without acting on failures (DMARC policy none is expected here).
  4. Read the reports and fix other senders. Check that HubSpot mail passes with an aligned DKIM signature, then find other services that fail both SPF and DKIM alignment and give each DKIM with your domain or an aligned return path.
  5. Move to quarantine. When the reports show all legitimate mail passing, change the policy to p=quarantine and keep the rua address.
  6. Move to reject. After a period at quarantine with no unexpected failures, change the policy to p=reject and keep reading reports for new senders.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

HubSpot's DMARC examples use pct to ramp up. The t=y flag (RFC 9989) and pct (RFC 7489, removed in RFC 9989) are not a safety net: RFC 7489 says unknown tags must be ignored, so a receiver that implements only RFC 7489 can apply p=reject; t=y as a full reject. HubSpot itself notes that pct "is sometimes ignored". Step from p=none to p=quarantine to p=reject instead. HubSpot counts a subdomain as authenticated when the root domain has a DMARC record.

Common mistakes

  • Two SPF records. HubSpot says to add its include to the existing record, not create a new one. See SPF multiple records.
  • Counting includes instead of lookups. HubSpot's troubleshooting page says you can have up to 10 include: statements. RFC 7208 limits DNS lookups to 10, and nested lookups count too.
  • Expecting SPF to align by default. On the shared network the return path is, in our reading, a HubSpot domain. Only DKIM can align by default. If the DKIM CNAMEs are missing, HubSpot will not send from example.com, and if they break later, HubSpot mail fails DMARC. See DKIM not found.
  • Duplicated domain in the host. Some DNS providers append the zone, giving hs1-123456._domainkey.example.com.example.com. Enter hs1-123456._domainkey only.
  • A null MX record. HubSpot advises against MX 0 . on a sending domain, because some providers reject mail from it.
  • Cloudflare proxy or CNAME flattening. HubSpot says to turn off domain-wide CNAME flattening and proxy settings for the sending domain.
  • Several DMARC records or a bad rua. HubSpot says multiple records stop policy discovery, and rua needs the mailto: prefix. See DMARC without rua.

How to check it

Run the email security check after each step. Use the SPF lookup counter to see how many of the 10 lookups your record uses, including the HubSpot include. In the DKIM selector finder, look for the hs1-... selector your setup screen shows. Build each DMARC stage with the DMARC record generator.

Sources

Frequently asked questions

Which SPF include does HubSpot use?

As of November 2026, HubSpot shows a value with a number in it in the Required data column when you connect the sending domain, such as include:123456.spf03.hubspotemail.net (123456 in its examples, a placeholder). Copy the value HubSpot shows you; if it is a full record and you already have SPF, copy only the include: term into your existing record.

Can I send from my own domain in HubSpot without DKIM?

No. HubSpot says you cannot send emails with your domain in the From address until you connect that domain by setting up DKIM. Until then, HubSpot rewrites the From address to a HubSpot managed domain, for example [email protected].

Does SPF on my From domain give HubSpot mail an aligned SPF pass?

Not by itself. On HubSpot's shared network the return path is, in our reading, a HubSpot domain, so SPF is checked on that domain. HubSpot still recommends adding its include to your From domain. Aligned SPF needs a custom return-path subdomain (Marketing Hub Enterprise) or a dedicated IP sending domain, which aligns in relaxed mode. In the default setup, DMARC depends on the HubSpot DKIM signature aligning. Check d= in a received message.

Will HubSpot set up my DMARC record?

No. HubSpot says its support cannot help with DMARC record setup and that you should work with whoever manages your DNS. The domain connection screen does generate a DMARC TXT record to add, and the domain only shows as Authenticated when DKIM, SPF and DMARC are all verified.