HubSpot DKIM setup: connect your email sending domain

HubSpot DKIM setup is part of connecting an email sending domain.

HubSpot’s email authentication documentation says the connection process sets up DKIM, SPF, and DMARC. DKIM requires two CNAME records, while SPF and DMARC use TXT records.

This guide focuses on DKIM because it is the most important piece for reliable DMARC alignment from a marketing platform.

Before you start

You need:

• HubSpot access with permission to connect domains.
• DNS access for the sending domain.
• The email address or subdomain you use for marketing email.
• A DMARC reporting address if DMARC is not already published.

If your marketing emails come from [email protected], connect example.com or the exact sending domain HubSpot asks for. If you use separate brands or subdomains, connect each one intentionally.

Step 1: connect an email sending domain

In HubSpot, go to Settings > Content > Domains & URLs.

Click Connect a domain, choose Email Sending, and enter the email address you use for marketing emails.

HubSpot will confirm the sending domain and then show DNS records. If your DNS provider supports automatic setup, HubSpot may offer that option. Manual setup is also available.

Step 2: publish the two DKIM CNAME records

For DKIM, HubSpot shows two CNAME records. Copy the values in the Host and Required data columns exactly.

Type	Host	Required data
CNAME	HubSpot DKIM host 1	HubSpot DKIM target 1
CNAME	HubSpot DKIM host 2	HubSpot DKIM target 2

Do not replace the target with a guessed HubSpot domain. The values are generated for your account and domain.

Before saving, check whether your DNS provider appends the root domain automatically. If HubSpot gives a full hostname and your DNS provider appends the domain again, validation will fail.

Step 3: review SPF and DMARC in the same flow

HubSpot’s authentication setup also checks SPF and DMARC.

If you already have an SPF record, HubSpot says to add its include value to the existing record rather than creating another SPF record. It also reminds you to include v=spf1 and -all only once.

For example, HubSpot shows SPF values in this shape:

v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all

Your exact HubSpot include is account-specific, so copy it from HubSpot.

If DMARC is missing, publish one record at _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected];

Step 4: verify in HubSpot

HubSpot says DNS records usually verify within 10 to 70 minutes, though some providers can take 24-48 hours.

Check the Email Sending tab in HubSpot. The domain should move from not authenticated or partially authenticated to authenticated after DKIM, SPF, and DMARC are verified.

Step 5: verify real HubSpot mail

Send a test marketing email to a mailbox you control.

Inspect authentication results:

• DKIM passes.
• The DKIM signing domain aligns with the From domain.
• DMARC passes.
• SPF has only one DNS record and stays under 10 lookups.

Use DMARCTrust for the DNS snapshot and your DMARCTrust dashboard for real traffic over time.

Common mistakes

Only setting SPF. HubSpot DKIM is what usually gives clean DMARC alignment.

Creating duplicate SPF or DMARC records. SPF and DMARC each allow one active record at their respective hostnames.

Copying another portal’s records. HubSpot records are account-specific.

Stopping at partially authenticated. For DMARC enforcement, get DKIM, SPF, and DMARC all verified.

FAQ

How many DKIM records does HubSpot use?

HubSpot uses two DKIM CNAME records for an email sending domain.

Does HubSpot provide an SPF include?

Yes, HubSpot shows an account-specific SPF include in the authentication flow. Merge it into your existing SPF record.

How do I verify HubSpot DKIM?

Check HubSpot domain status, send a real test email, and confirm DKIM and DMARC pass in the headers.