HubSpot connects an email sending domain with two DKIM CNAME records, one SPF include, one DMARC TXT record and a check on your MX record. All four appear under Settings > Content > Domains & URLs > Email Sending. On HubSpot's shared IPs, the DKIM signature is what aligns for DMARC. SPF passes on HubSpot's own bounce domain instead.
The records at a glance
| Record | Type | Host | Value |
|---|---|---|---|
| DKIM 1 | CNAME | shown by HubSpot, ends ._domainkey |
…hs01a.dkim.hubspotemail.net |
| DKIM 2 | CNAME | shown by HubSpot, ends ._domainkey |
…hs01b.dkim.hubspotemail.net |
| SPF | TXT | @ |
v=spf1 include:123456.spf03.hubspotemail.net -all |
| DMARC | TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
HubSpot generates the host names and values per account, so copy them from the Host and Required data columns. For reference, on 19 October 2026 HubSpot's own domain published hs1._domainkey.hubspot.com pointing to hubspot-com.hs01a.dkim.hubspotemail.net and hs2._domainkey.hubspot.com pointing to hubspot-com.hs01b.dkim.hubspotemail.net. The SPF value in the table is HubSpot's documented example, not a value to paste.
Connect the domain in HubSpot
You need Domain settings permissions.
- Click the settings icon in the top bar.
- In the left sidebar go to Content > Domains & URLs, then the Email Sending tab.
- Click Connect sending domain in the top right.
- Enter an address you send marketing email from and click Next. Confirm the domain and click Next again.
- Choose Sign in with [provider] if your DNS host is supported, or No, I'll set it up manually.
- For each record, click Copy next to the Host and Required data values and paste them at your DNS host.
Two limits from HubSpot's guide shape the choice of domain. The sending domain cannot already host content, such as your website. A subdomain like info.example.com is fine, but it must match the domain in the From address you use. An account can connect up to 2,000 sending domains.
DKIM: the two CNAMEs
This is the part people half-finish. HubSpot's guide says DKIM requires two CNAME records, so publish both before you click verify.
Each CNAME points the selector at a key that HubSpot hosts. When a receiver checks a HubSpot message, the DKIM-Signature carries d=example.com and a selector such as hs1. The lookup follows your CNAME into hubspotemail.net and finds the key. Because d= is your domain, the signature aligns with your From address under relaxed DMARC alignment (RFC 7489).
HubSpot's overview is blunt about the cost of skipping this. You cannot send with your own domain in the From address until DKIM is connected. Without it, HubSpot rewrites the sender to something like user=yourcompany.com@hs-domain.com.
SPF: recommended, but not your DMARC pass
HubSpot's overview separates two things. SPF is checked against the envelope return path, the address bounces go to. On shared servers HubSpot has already set that up on its own domain. Dedicated IP customers have to configure SPF on their own return-path domain during IP setup.
HubSpot still recommends adding its include to your From domain, and the connect wizard asks for it. If you already have SPF, add the include to the existing record. Do not create a second one:
v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all
Keep one v=spf1 and one all at the end. Each include costs lookups toward the limit of 10 set by RFC 7208, and a CRM, a help desk and a mailbox provider together can come close. Run the SPF checker after the change.
Watch for an inconsistency in HubSpot's own article. The connection steps show an account-specific hubspotemail.net include, while the troubleshooting section tells you to look for include:shared.hubspot.com. In our scan of the Tranco top 1,000 domains on 19 October 2026, 39 domains used an account-specific include (spf01 through spf07.hubspotemail.net) and only one used shared.hubspot.com. Use whatever your wizard shows.
DMARC and MX
The wizard also checks for a DMARC TXT record. HubSpot's overview recommends relaxed alignment for both adkim and aspf, which is the default when you leave those tags out. A subdomain counts as authenticated if the root domain has DMARC, because the root policy covers subdomains. If you have no record yet, start with p=none and a reporting address from the DMARC generator.
MX is the newer check. HubSpot warns against a null MX (MX 0 .) on the sending domain, because some inbox providers reject mail from domains that say they accept none. If a send-only subdomain should not receive mail, leave MX unset rather than null.
Pitfalls specific to HubSpot
- Cloudflare. Turn off domain-wide CNAME flattening and the proxy on the DKIM records, as HubSpot's requirements list says.
- Timing. HubSpot says records usually update in 10 to 70 minutes and can take 48 hours. Wait at least 20 minutes before you re-check.
- Status labels. A domain stuck on Partially authenticated has working DKIM. HubSpot just has not verified SPF or DMARC yet, and Continue setup shows you the record it still wants.
- Changing domains. HubSpot advises authenticating the new domain fully before any marketing send from it.
Check the result
- DKIM checker: use the selector that appears before
._domainkeyin HubSpot's Host column, then repeat for the second record. - SPF checker: confirm one record and a lookup count under 10.
- DMARC checker: confirm one record at
_dmarc.
Then send a test email to a Gmail inbox and open Show original. You want dkim=pass with header.d=example.com and dmarc=pass. The aggregate report analyzer will show HubSpot traffic as DKIM-aligned once reports arrive.