HubSpot Email: SPF, DKIM & DMARC Setup Guide
HubSpot's email tool requires DNS-level authentication to send with your own domain. Getting SPF, DKIM, and DMARC right ensures your campaigns land in the inbox — not the spam folder.
1SPF Record Setup
Recommended SPF record for HubSpot:
v=spf1 include:servers.hubspotemail.net ~allHubSpot's SPF include may vary depending on your account and configuration. Check HubSpot's Domain Settings for the exact include value. If using both HubSpot and Google Workspace, combine: v=spf1 include:_spf.google.com include:servers.hubspotemail.net ~all
Step-by-step setup:
- 1In HubSpot, go to Settings → Website → Domains & URLs → Connect a domain
- 2Or for email authentication: Settings → Marketing → Email → Sending Domains
- 3HubSpot provides DNS records to add (usually CNAME for DKIM)
- 4Add the records to your DNS provider
- 5Update your root domain SPF to include: include:servers.hubspotemail.net
- 6Verify in HubSpot settings
2DKIM Setup
Example DKIM record location:
hs1._domainkey.yourdomain.comHubSpot provides CNAME records for DKIM authentication. The selector prefix varies. Follow HubSpot's domain setup wizard for the exact records to add.
Step-by-step setup:
- 1In HubSpot, go to Settings → Marketing → Email → Sending Domains
- 2Add your sending domain and click Configure DNS Records
- 3HubSpot provides CNAME records for DKIM
- 4Add the CNAME records to your DNS
- 5Click Verify in HubSpot once propagated
- 6Test with our DKIM checker
3DMARC Policy
Recommended DMARC record:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100Add as a TXT record at: _dmarc.yourdomain.com
With HubSpot DKIM authentication in place, DMARC will pass via DKIM alignment. Publish your DMARC policy at _dmarc.yourdomain.com to protect your domain from spoofing.
Common HubSpot Deliverability Issues
HubSpot emails showing low open rates
Check if your domain or sending IPs are blacklisted. Verify SPF and DKIM are passing in HubSpot's Email Health dashboard. Review list hygiene — unsubscribe inactive contacts.
Domain connection failing in HubSpot
Ensure all CNAME records are added correctly. CNAME records cannot coexist with A or AAAA records at the same subdomain. Use a subdomain like 'hs' or 'email' rather than your root domain.
Marketing emails hitting spam with authentication passing
Authentication passing is necessary but not sufficient. Review your email content, sending frequency, engagement rates, and list quality. High complaint rates override good authentication.
Is Your HubSpot Domain Blacklisted?
Authentication passing is necessary — but not sufficient. Check if your sending domain or IP is on any of 60 blacklists. Free, instant, no signup.
Check Your Domain FreeChecks all 60 blacklists + SPF, DKIM, DMARC, MX in under 10 seconds