SPF, DKIM & DMARC for HubSpot.

Why authenticate HubSpot?

Authenticating your HubSpot sending domain isn't housekeeping — it's the difference between the inbox and the spam folder, and HubSpot now effectively requires it. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day to consumer inboxes) to pass SPF, DKIM, and DMARC with alignment, and Microsoft extended the same rules to Outlook.com/Hotmail/Live in 2025. HubSpot responded by pushing domain connection hard: campaigns from free public From addresses (gmail.com, yahoo.com) are blocked, and an unconnected domain sends under HubSpot's own identity — drawing a "via hubspotemail.net" notice while your reputation pools with every other unauthenticated HubSpot sender. There's a HubSpot-specific twist that makes the two DKIM CNAMEs non-negotiable: on shared sending HubSpot processes bounces on its own Return-Path (a hubspotemail.net bounce domain), so SPF is always checked against HubSpot's domain, never your From domain. SPF may raw-"pass," but it does not align — and DMARC only counts SPF when it aligns. That leaves DKIM, signed as d=yourdomain.com via the hs1/hs2 selectors, as the only aligned mechanism carrying your DMARC pass. Skip the CNAMEs and you have no aligned authentication at all, and the sending reputation you build never accrues to your own domain.

The SPF reality for HubSpot

HubSpot is a per-account provider, closer to Amazon SES than to a single-shared-include sender like Google Workspace or Microsoft 365. There is no one "include:_spf.hubspotemail.net" that every customer pastes: when you connect an email sending domain, HubSpot generates account-specific values — two DKIM CNAMEs whose targets embed a portal-specific selector version (yourdomain-com.hs01a.dkim.hubspotemail.net, hs01b, and so on), plus an account-specific SPF include of the form include:NNNNNN.spfNN.hubspotemail.net (where NNNNNN is your Hub ID, e.g. include:123456.spf03.hubspotemail.net). HubSpot does recommend adding that SPF include to your From-address domain's root SPF, and that's genuinely useful — but here's the nuance almost every old tutorial gets wrong: it will not, on its own, make DMARC pass. Because HubSpot owns the Return-Path (bounces are processed on hubspotemail.net for shared senders), SPF is evaluated against HubSpot's bounce domain, so it raw-passes for hubspotemail.net but does not align to your organizational domain — and DMARC only credits an aligned SPF result. That is exactly why HubSpot leads with two DKIM CNAMEs: DKIM signed as d=yourdomain.com is the mechanism that aligns and carries your DMARC pass, and the SPF include is belt-and-suspenders for the raw SPF check. Two rules follow. First, copy the exact account-specific include from your portal (Domains & URLs > Advanced Options > Copy SPF record) — never guess a generic value; the NNNNNN and spfNN segments are yours. Second, keep exactly one SPF TXT record on the domain: merge the HubSpot include into your existing v=spf1 line rather than publishing a second SPF record (two is a PermError), and it counts toward your 10-lookup limit. If you actually want SPF to align too, HubSpot offers a custom Return-Path — but it's a Marketing Hub Enterprise feature, and under strict DMARC alignment it only works when your sending domain is a subdomain (mail.company.com), not the root company.com.

Two ways to set it up

Step by step

Records to add

HubSpot generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what HubSpot's setup costs against that budget.

Check it actually worked

Don't trust HubSpot's "Connected" badge alone — confirm it on a real message. Send a test from HubSpot to a Gmail account, open it, and choose the three-dot menu > Show original. You want DKIM: PASS with signed-by / d=yourdomain.com (the tell-tale failure is d=hubspotemail.net or an "on behalf of" line, which means the CNAMEs aren't verified or the From address isn't on the connected domain) and DMARC: PASS. SPF will typically show hubspotemail.net rather than your domain — that is expected because HubSpot owns the Return-Path, and DKIM is what carries the alignment, so a passing-but-unaligned SPF here is not a problem. You can spot-check the raw records with dig CNAME hs1._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com. Finally, run the domain through Qualisend's domain health check to confirm both DKIM CNAMEs, your merged SPF, and the DMARC record all resolve and that SPF stays under the 10-lookup limit — and once aggregate reports start arriving, drop one into the DMARC report analyzer to verify HubSpot shows up as a DKIM-aligned, passing source.

Common gotchas

• DNS setup

  SPF doesn't align on HubSpot: on shared sending the default Return-Path is on hubspotemail.net, so SPF raw-passes for HubSpot but not for your domain. The two DKIM CNAMEs (d=yourdomain.com) are the ONLY aligned mechanism — adding the SPF include by itself will not get you a DMARC pass.

• Coverage

  Copy the exact account-specific values. The DKIM targets (yourdomain-com.hsNNa/hsNNb.dkim.hubspotemail.net) and the SPF include (include:NNNNNN.spfNN.hubspotemail.net) are unique to your portal. Guessing a generic include:_spf.hubspotemail.net or the wrong selector-version segment breaks verification.

• Coverage

  Custom Return-Path is Enterprise-only and subdomain-only: the custom Return-Path that would make SPF align is a Marketing Hub Enterprise feature, and under strict DMARC alignment it's supported only when you send from a subdomain like mail.company.com — not the root company.com. If SPF alignment matters to you, you need both.

• DNS setup

  HubSpot won't help with DMARC. HubSpot Support explicitly can't assist with the _dmarc record, and HubSpot never creates it — you must publish one yourself and start at p=none.

• DNS setup

  Cloudflare proxy breaks the CNAMEs: set both hs1._domainkey and hs2._domainkey to DNS only (grey cloud). An orange-cloud proxied CNAME won't resolve to hubspotemail.net and the domain won't connect.

• DNS setup

  Host-field doubling: many registrars auto-append your domain, so entering hs1._domainkey.yourdomain.com becomes hs1._domainkey.yourdomain.com.yourdomain.com. Enter just the label (hs1._domainkey, hs2._domainkey) when the panel adds the domain for you.

• Breaks auth

  Keep exactly one SPF TXT record. Merge HubSpot's include into your existing v=spf1 line — two SPF records is a PermError — and remember it counts toward the RFC 7208 limit of 10 DNS lookups.

• Coverage

  Connecting the domain isn't the same as using it. After DNS verifies, set your marketing email's From address (and the email preference/subscription domain) to the connected domain, or your mail keeps sending unaligned under HubSpot's identity.

Build your SPF record

HubSpot doesn't need an SPF include: on your root domain — use the generator to assemble one clean record for your other senders, and keep it to a single line.

HubSpot SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.