--- title: "How To Add HubSpot DMARC, SPF, and DKIM Records Correctly? | AutoSPF" description: "Learn how to add HubSpot DMARC, SPF, and DKIM records correctly to improve email authentication, boost deliverability, and prevent spoofing." image: "https://autospf.com/og/blog/how-to-add-hubspot-dmarc-spf-and-dkim-records-correctly.png" canonical: "https://autospf.com/blog/how-to-add-hubspot-dmarc-spf-and-dkim-records-correctly/" --- Quick Answer To add HubSpot DMARC, SPF, and DKIM records, connect your sending domain in HubSpot, add the required DNS records at your DNS provider, then verify them in HubSpot. Proper authentication improves email deliverability, protects against spoofing, and helps emails reach inboxes. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-add-hubspot-dmarc-spf-and-dkim-records-correctly%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20To%20Add%20HubSpot%20DMARC%2C%20SPF%2C%20and%20DKIM%20Records%20Correctly%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-add-hubspot-dmarc-spf-and-dkim-records-correctly%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-add-hubspot-dmarc-spf-and-dkim-records-correctly%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-add-hubspot-dmarc-spf-and-dkim-records-correctly%2F&title=How%20To%20Add%20HubSpot%20DMARC%2C%20SPF%2C%20and%20DKIM%20Records%20Correctly%3F "Share on Reddit") [ ](mailto:?subject=How%20To%20Add%20HubSpot%20DMARC%2C%20SPF%2C%20and%20DKIM%20Records%20Correctly%3F&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-add-hubspot-dmarc-spf-and-dkim-records-correctly%2F "Share via Email") ![HubSpot DMARC](https://media.mailhop.org/autospf/sender-policy-framework-6432-1781871801993.jpg) When you send marketing emails through HubSpot, mailbox providers such as Gmail, Yahoo Mail, and M365 check whether your messages are properly authenticated. This is where [email authentication](https://autospf.com/blog/how-has-email-authentication-evolved-over-the-years/) becomes essential. HubSpot relies on authentication methods such as SPF, DKIM, and DMARC to prove that your email sending domain is authorized to send messages through the HubSpot [marketing platform](https://www.indeed.com/career-advice/career-development/what-is-a-marketing-platform). Without correct DNS records, your marketing emails may appear suspicious, even if your content is legitimate. Poor or missing email authentication can damage your sender reputation, reduce your email reputation, and **cause messages to land in spam**. In some cases, Gmail or Yahoo Mail may reject emails entirely if SPF, DKIM, or DMARC alignment fails. SPF helps identify which mail servers are allowed to send on behalf of your domain. DKIM adds a cryptographic signature to your emails, allowing receiving servers to verify that the message was not altered. _DMARC tells mailbox providers what to do when SPF or DKIM fails and can also report failed authentication attempts_. Together, these authentication methods protect against email spoofing and improve deliverability. For HubSpot users, domain authentication is especially important because marketing emails are sent from HubSpot infrastructure, often using HubSpot-managed systems such as hubspotemail.net. Whether you use a **dedicated IP address** or shared IP addresses, your [DNS records](https://www.cloudns.net/wiki/article/9/) must correctly identify HubSpot as an approved sender. ![Email Authentication Pillars](https://media.mailhop.org/autospf/multiple-spf-records-3577-1781872114730.jpg) ## Prerequisites: Accessing HubSpot Email Settings and Your DNS Provider Before adding HubSpot DMARC, SPF, and DKIM records, make sure you have the correct access in both HubSpot and your DNS provider. You need a HubSpot user account with proper user permissions to connect an email sending domain. In many portals, access controls may restrict who can update domain connection settings, so confirm that your account can manage [domain authentication](https://support.virtuous.org/hc/en-us/articles/14654184844173-What-is-Domain-Authentication-for-Email). In HubSpot, click the settings icon, then go to Content > Domains & URLs. You may also see this area labeled as Domains & URLs, **depending on your HubSpot interface**. From there, open the Email Sending tab to start the domain connection process for your email sending domain. You will also need access to your DNS provider, such as Cloudflare, GoDaddy, Namecheap, or your hosting provider. This is where you manage [DNS settings](http://www.ntchosting.com/encyclopedia/dns/settings/) for your root domain or subdomain. For example, if your business sends from `mydomain.com`, your DNS records may be added at the root domain level. If you send from a subdomain such as `newsletter.yourcomany.com`, the DNS records must be added for that specific subdomain. Before making changes, confirm: - Your **From email address**, such as [no-reply@domain.com](mailto:no-reply@domain.com) - Whether you are authenticating the root domain or a subdomain - Whether your DNS provider supports CNAME records and [TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/) entries - Whether you are using a dedicated IP or shared IP address in HubSpot - Whether two-factor authentication (2FA) is enabled on your user account for security _If your company has strict access controls or a password protected DNS management workflow, coordinate with your IT team_. For complex accounts, HubSpot Support or your HubSpot account manager can help review setup instructions. The HubSpot Community is also useful for troubleshooting provider-specific issues, including Cloudflare proxy settings or M365-related sender information questions. ## Configuration Steps for HubSpot SPF, DKIM, and DMARC ### How to Add and Verify HubSpot SPF and DKIM Records Correctly To add SPF and DKIM in HubSpot, begin in Content > Domains & URLs, then open the Email Sending tab. Choose to connect an **email sending domain** and follow HubSpot’s setup instructions. HubSpot will generate the required DNS records for your domain verification. For most accounts, HubSpot provides CNAME records for DKIM. These CNAME records point your domain to HubSpot-managed authentication hosts. DKIM is typically the most important email authentication method for HubSpot because it signs your marketing emails and helps mailbox providers confirm that HubSpot is authorized to send for your email sending domain. ![DNS Configuration Checklist](https://media.mailhop.org/autospf/how-to-set-up-spf-and-dkim-3578-1781872272988.jpg) HubSpot may also provide SPF guidance. In many cases, SPF is configured through a TXT record using an include mechanism that authorizes HubSpot. A typical SPF record may reference HubSpot infrastructure, though you should always copy **the exact SPF record value** from your HubSpot portal rather than guessing. #### HubSpot SPF and DKIM Values You’ll See HubSpot usually displays a host/name field and a value/target field for each DKIM record. In your DNS provider, you add these as CNAME records. Avoid manually editing the value unless your DNS provider requires a specific formatting adjustment. ##### SPF Record Notes _An SPF record is published as a TXT record in the Domain Name System (DNS)_. If your domain already has an SPF record for M365, [Google Workspace](https://nethunt.com/blog/what-is-google-workspace/), or another platform, do not create a second SPF record. Instead, update the existing SPF record with the HubSpot include mechanism. **Multiple SPF records** can cause SPF failure and hurt deliverability. For example, if `mydomain.com` already authorizes M365, your SPF record may need to include both M365 and HubSpot. The exact syntax depends on your existing email policies, so validate carefully before saving. ##### DKIM CNAME Records Notes DKIM for HubSpot usually requires two CNAME records. These CNAME records allow HubSpot to sign marketing emails using your authenticated **email sending domain**. In Cloudflare, make sure DKIM CNAME records are set to DNS-only, not proxied. A proxied DKIM record can break email authentication because receiving servers need to resolve the CNAME records directly. After adding the SPF record and DKIM record values, return to HubSpot and click verify. HubSpot will check the authentication status of your DNS records. [DNS propagation](https://www.networksolutions.com/blog/what-is-dns-propagation/) can take minutes or several hours, depending on your DNS provider. ![DMARC Rollout Strategy Step-Chart](https://media.mailhop.org/autospf/microsoft-account-security-alert-5224-1781872369280.jpg) ### How to Set Up a DMARC Record for HubSpot Emails A DMARC record is also added as a TXT record in your DNS provider. DMARC builds on SPF and DKIM by defining how receiving mail servers should handle failed email authentication. It is an [authentication protocol](https://supertokens.com/blog/authentication-protocols) that also provides reporting, **helping you monitor email** spoofing and unauthorized use of your domain. A basic DMARC record for a domain might look like this: ``` Name: _dmarc.mydomain.com Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@mydomain.com ``` The `p=none` setting is a neutral policy. It allows you to collect reports without telling [mailbox providers](https://grokipedia.com/page/Mailbox%5Fprovider) to reject or quarantine mail. This is useful when transitioning domains, cleaning up subscribers, or checking whether all legitimate senders are properly aligned. Once you **understand your authentication results**, you can move from a neutral policy to stricter email policies, such as: - **p=quarantine**: suspicious emails may be placed in spam or quarantine - **p=reject**: failed messages may be rejected outright _For HubSpot marketing emails, DMARC alignment usually depends on DKIM alignment with your email sending domain_. That is why correct **DKIM CNAME records** are critical. If DKIM passes and aligns, DMARC can pass even if SPF alignment is not ideal due to HubSpot’s sending architecture. DMARC is especially important for brands sending from addresses such as [no-reply@domain.com](mailto:no-reply@domain.com), because attackers often imitate no-reply address formats. A properly configured DMARC record helps receiving providers verify sender information and protect subscribers from phishing. ## Common HubSpot DMARC, SPF, and DKIM Mistakes and How to Fix Them One common mistake is adding duplicate SPF records, which is why many organizations use [AutoSPF](https://autospf.com/) to manage SPF configurations across multiple email platforms. A domain should have only one SPF TXT record. If you use M365, HubSpot, and another marketing platform, combine authorized services into one SPF record using the **correct include mechanism**. ![Mastering HubSpot Email Authentication: SPF, DKIM, and DMARC Setup](https://media.mailhop.org/autospf/spf-kitterman-6225-1781873408580.jpg) Another common issue is adding DKIM CNAME records incorrectly. Some DNS providers automatically append the root domain, which can turn a valid host into a duplicated name, such as `selector._domainkey.mydomain.com.mydomain.com`. If HubSpot shows DKIM as unverified, compare the exact host and value fields in your DNS provider. Cloudflare users should also confirm that HubSpot CNAME records are not proxied. DKIM CNAME records must be DNS-only. If they are orange-cloud proxied, DKIM authentication may fail, and **deliverability can suffer**. DMARC mistakes usually involve enforcing quarantine or reject too quickly. Best practices recommend starting with a neutral policy, reviewing reports, then moving gradually to quarantine or reject. This phased announcement approach is useful when transitioning domains, launching a new subdomain, or moving from shared IP addresses to a dedicated IP. A poor sending strategy can also harm [email deliverability](https://autospf.com/blog/best-email-deliverability-tools-in-2026/) even when SPF, DKIM, and DMARC are technically correct. If you are using a new email sending domain, warm up domain activity gradually. Avoid sending large campaigns to old **contact lists without cleaning** up subscribers first. Monitor subscriber feedback, spam complaints, bounces, and engagement signals. _If messages still fail authentication, check the HubSpot authentication status in the Email Sending tab_. Compare each DKIM record, SPF record, and DMARC record against your DNS records. For unusual cases, such as a domain named Timbrowntown or a complex multi-brand setup, contact HubSpot Support, consult your HubSpot account manager, or search the HubSpot Community for provider-specific examples. Finally, **remember that email authentication** is not a one-time task. Review DNS records whenever you change your email sending domain, add a dedicated IP, switch DNS provider, update your From email address, or add a new subscriber allowlist process. Correct HubSpot SPF, DKIM, DMARC, and [CNAME records](https://www.ibm.com/think/topics/cname) create the technical foundation for strong deliverability and safer marketing emails. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 3m 5 key contributors to the development of the Sender Policy Framework Nov 12, 2024 ](/blog/5-key-contributors-to-sender-policy-framework-development/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How To Add HubSpot DMARC, SPF, and DKIM Records Correctly?","description":"Learn how to add HubSpot DMARC, SPF, and DKIM records correctly to improve email authentication, boost deliverability, and prevent spoofing.","url":"https://autospf.com/blog/how-to-add-hubspot-dmarc-spf-and-dkim-records-correctly/","datePublished":"2026-06-19T00:00:00.000Z","dateModified":"2026-06-19T00:00:00.000Z","dateCreated":"2026-06-19T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-to-add-hubspot-dmarc-spf-and-dkim-records-correctly/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/sender-policy-framework-6432-1781871801993.jpg","caption":"HubSpot DMARC"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How To Add HubSpot DMARC, SPF, and DKIM Records Correctly?","item":"https://autospf.com/blog/how-to-add-hubspot-dmarc-spf-and-dkim-records-correctly/"}]} ```