HubSpot: DKIM and SPF setup

Before you start

Connecting an email sending domain is available on the Starter, Professional and Enterprise editions of Marketing Hub, Sales Hub, Service Hub and Content Hub. You need Domain settings permissions in HubSpot.

You also need access to the DNS settings of example.com. HubSpot connects only a domain that is not used for something else, such as hosting your website. You can connect a subdomain, such as info.example.com, if it matches the From address of your marketing email. If your DNS is at Cloudflare, HubSpot asks you to turn off domain-wide CNAME flattening and the proxy for these records.

Turn on DKIM

HubSpot calls this connecting an email sending domain. It sets up DKIM with two CNAME records, SPF with a TXT record, and DMARC with a TXT record. HubSpot generates the record names and values for your account.

1. In HubSpot, click the settings icon in the top navigation bar.
2. In the left sidebar, go to Content > Domains & URLs.
3. Click the Email Sending tab, then Connect sending domain in the top right.
4. Enter an email address you send marketing email from, and click Next. Check that the sending domain is right, and click Next again.
5. Click Sign in with your DNS host to let HubSpot add the records, or click No, I'll set it up manually.
6. For manual setup, click Copy next to the Host and Required data values of each record, and paste them into your DNS host.

About the DMARC record. A domain may have only one DMARC record. If example.com already has a DMARC record, it sends reports to your reporting address. Do not add a second one. HubSpot also treats a subdomain as authenticated when its parent domain has a DMARC record.

HubSpot says you cannot send with example.com in the From address until you connect it by setting up DKIM.

Sign with your own domain

Reports show HubSpot mail signed by one of HubSpot's domains, which does not align with example.com. Connect example.com as a sending domain, as in Turn on DKIM. With the DKIM records under example.com, DKIM can align.

Use your own bounce domain

HubSpot says the return path domain cannot be customized on its shared sending network. It can be customized with the dedicated IP add-on or the transactional email add-on. Without one of them, SPF does not align for HubSpot mail.

DMARC needs only one of SPF and DKIM to align. Connect example.com as in Turn on DKIM, and HubSpot mail passes DMARC through DKIM.

SPF

HubSpot already has SPF set up for the return path domain of mail sent through its shared servers. It still recommends adding HubSpot to the SPF record of your From domain, with the value shown in your HubSpot domain settings.

If example.com already has an SPF record, add HubSpot's include to it instead of creating a second record. Keep v=spf1 and the all ending only once. HubSpot's example looks like this, with its own number in place of 123456:

v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all

HubSpot's troubleshooting section says to check that the SPF record includes include:shared.hubspot.com. Use the value HubSpot shows for your account.

Check it worked

1. HubSpot suggests waiting at least 20 minutes after you add the records. Records usually update within 10 to 70 minutes, and sometimes take up to 48 hours.
2. In Content > Domains & URLs > Email Sending, the domain shows Authenticated when DKIM, SPF and DMARC are all verified. Partially authenticated means DKIM works but SPF or DMARC does not yet. Click Continue setup to see the missing values.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for HubSpot. The DKIM table on Mailmoni's DNS tab lists HubSpot's selectors once a report includes them.

HubSpot's pages: Connect your email sending domain, Overview of email authentication and Understand email sending in HubSpot.