Setup Guide

How to Set Up SPF, DKIM, and DMARC for HubSpot

HubSpot is a popular CRM and marketing platform that sends transactional emails, marketing campaigns, and sales sequences on behalf of your domain. Proper authentication ensures these messages are trusted by receiving mail servers and protects your domain from spoofing.

SPF Configuration

HubSpot provides a dedicated SPF include for their sending infrastructure.

DNS Record:

Type:  TXT
Host:  @
Value: v=spf1 include:spf.hubspot.com ~all

Combined with other services:

v=spf1 include:_spf.google.com include:spf.hubspot.com ~all

Verify your total lookup count with the SenderClarity SPF Checker after adding this record.

DKIM Configuration

HubSpot supports custom DKIM through their email sending domain settings.

  1. In HubSpot, go to Settings → Content → Domains & URLs → Email Sending Domains (or Settings → Website → Domains & URLs depending on your version).
  2. Click Connect an email sending domain.
  3. Enter your domain name.
  4. HubSpot will provide two CNAME records for DKIM:
Type:  CNAME
Host:  hs1._domainkey
Value: (provided by HubSpot — unique to your portal)

Type:  CNAME
Host:  hs2._domainkey
Value: (provided by HubSpot — unique to your portal)
  1. Add both CNAME records to your DNS.
  2. Return to HubSpot and click Verify.

HubSpot uses two selectors for redundancy and key rotation, similar to Microsoft 365.

DMARC Configuration

Start with monitoring mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:your-address@reports.senderclarity.com; fo=1

Move toward enforcement after confirming all legitimate sources pass:

  1. p=quarantine; pct=25
  2. p=quarantine; pct=100
  3. p=reject

Verification

  • Check your SPF record →
  • Send a test marketing email to an address you control
  • Check email headers for dkim=pass aligned to your domain
  • Monitor DMARC reports in SenderClarity

Common Issues

DKIM not passing after setup: HubSpot DKIM verification can take up to 24 hours. If it still fails, verify the CNAME records exactly match what HubSpot provided — including any trailing dots that your DNS provider may or may not require.

Emails show "via hubspot.com": This typically appears in Gmail when DKIM is not yet configured for your domain. Once custom DKIM is active and verified, this label should disappear.

Multiple HubSpot portals: If your organization uses separate HubSpot portals (e.g., for different brands or regions), each portal needs its own email sending domain configuration. The SPF include only needs to appear once.

SPF Lookup Impact

Include Estimated Lookups
spf.hubspot.com 1–2