HubSpot Email Authentication: Sending Domain & DKIM

What HubSpot authenticates for you (and what it does not)

• DKIM - HubSpot does this for you. Two CNAME records point at HubSpot-hosted keys; HubSpot generates and rotates the key material behind them, so you never hold or rotate a raw DKIM key. This is the one record set required to send authenticated mail from your domain.
• SPF - recommended, and yours. HubSpot's docs call SPF "not strictly required" but advise adding it. On the shared network SPF passes against HubSpot's own return-path domain, so it does not align to you - DKIM carries DMARC. You add the SPF include to your domain's single v=spf1 record.
• DMARC - entirely yours. HubSpot never publishes DMARC ("unique to your business needs and your DNS provider"). You add _dmarc.yourdomain.com yourself.

The upshot: DKIM alone gets you a DMARC pass (once a DMARC policy is published) because the signature's d= is your own domain. A complete setup is the two DKIM CNAMEs + your SPF include + your own DMARC record - and, if you need SPF to align too, a custom return-path subdomain on Enterprise.

What you need

• A HubSpot account with access to Settings → Content → Domains & URLs → Email Sending.
• Access to your domain's public DNS - and, on Cloudflare, the ability to set records to DNS only (grey cloud).
• A sending domain (or subdomain) that matches your From address and is not already in use for another purpose such as hosting your website.

The setup, step by step

Type   Host                              Value
CNAME  hs1._domainkey.yourdomain.com     [exact target from HubSpot]
CNAME  hs2._domainkey.yourdomain.com     [exact target from HubSpot]

Type  Host             Value
TXT   yourdomain.com   v=spf1 include:[HubSpot's exact include] include:_spf.google.com ~all

Type  Host                    Value
TXT   _dmarc.yourdomain.com   v=DMARC1; p=none; rua=mailto:[email protected]

How SPF, DKIM and DMARC line up here

• DKIM - the CNAMEs live at hsN._domainkey.yourdomain.com, so the signature's d= is your organizational domain. With the From address on the same domain, DKIM aligns (relaxed, DMARC's default) - this is the path that passes DMARC without any SPF work.
• SPF - on the shared network the envelope-from (return-path) is HubSpot's domain: SPF passes but is not aligned to you, so it does nothing for DMARC. A custom return-path subdomain (Enterprise) moves the envelope-from under your domain and gives you SPF alignment too.
• DMARC - passes when either SPF or DKIM aligns; HubSpot satisfies that through DKIM immediately. HubSpot also notes that a sending subdomain counts as authenticated for DMARC when a DMARC record exists at your root domain - so an organizational-domain policy covers the subdomain by inheritance, and you don't need a separate _dmarc on the subdomain. See our SPF, DKIM and DMARC guide for how the three fit together, and keep alignment relaxed - adkim=s can break a subdomain send.

Custom return-path and dedicated IP

Two upgrades change the DNS picture. A custom return-path (a branded bounce subdomain such as bounce.yourdomain.com) makes SPF align to your domain and "help[s] prove that your emails come from a trusted source"; it requires Marketing Hub Enterprise, or Marketing Hub Professional/Enterprise with the Dedicated IP or Transactional Email add-on, and HubSpot shows the exact records in-portal. A dedicated IP is a Professional/Enterprise add-on, "a good fit for accounts that send a high volume of email" (HubSpot publishes no numeric threshold); it obliges you to publish the records HubSpot lists for it - an A record (mapping your dedicated IP to the domain), an MX record (priority 0, which processes bounces, spam reports and unsubscribes), an SPF TXT and the DKIM CNAME - and to warm the IP. If you set a custom PTR on a dedicated IP, configure forward-confirmed reverse DNS (the PTR resolves to a hostname whose A/AAAA resolves back to the same IP) or Gmail can reject with 550 5.7.25 - see our SMTP error codes reference. Most senders should stay on shared IPs until volume justifies the warmup.

Gmail and Yahoo bulk-sender rules

Google and Yahoo now require bulk senders to have DKIM, SPF and DMARC fully set up on the sending domain, and non-compliant mail can bounce - HubSpot flags this as the reason to complete all three records rather than stopping at DKIM. The two CNAMEs authenticate you, but the Gmail and Yahoo rules expect a visible SPF and a published DMARC policy on the sending domain too. Once you're at an enforced DMARC policy (p=quarantine or p=reject), you can add BIMI to display your logo at supporting inbox providers - see our BIMI setup guide.

The failures we keep finding

Verify it end to end

HubSpot showing Authenticated means the records exist - it doesn't prove a real send passes. Confirm on an actual message:

• Send a HubSpot marketing email to a seed address, then run it through Postbox Mailtester and confirm DKIM pass with d=yourdomain.com and DMARC pass (aligned) - plus SPF aligned if you set a custom return-path.
• Or read the received message's Authentication-Results header: dkim=pass header.d=yourdomain.com and dmarc=pass. If DKIM shows a d= that isn't your domain, either the CNAMEs aren't resolving to HubSpot's key or the wrong sending domain is selected - re-check step 2 and the connected domain.

Frequently asked questions

Sources (HubSpot Knowledge Base): Overview of email authentication · Manage email authentication · Use a DMARC policy with HubSpot · Custom return-path · Connect a dedicated IP.