SPF record for HubSpot

HubSpot sends marketing email, sequences and workflow notifications. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

HubSpot's include is specific to your account. It carries an identifier for your portal in front of a hubspotemail.net host, so there is no single correct value to print here. A value copied from someone else's setup is the wrong one for you. Take it from Settings, Content, Domains and URLs, Email sending domain, at the point where HubSpot lists the DNS records to publish.

It's one include, and it counts against your ten lookups like any other.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count.

DKIM

HubSpot uses CNAMEs under _domainkey with selectors it generates for your portal, pointing at hosts under hubspotemail.net. Publish exactly the pair the connect-a-domain wizard shows, then let HubSpot verify them. HubSpot usually finishes within minutes and shows you which record is still missing.

DMARC alignment with HubSpot

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• HubSpot sends marketing mail from the connected sending domain, which is often a subdomain. Relaxed DMARC alignment covers that, but strict alignment (adkim=s) does not, and setting strict alignment is a decision people make without realizing it breaks every subdomain sender they have.
• Sales sequences sent through a connected personal inbox go out through Google or Microsoft, so that provider's records cover them.
• A domain can only be connected to one HubSpot account at a time.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through HubSpot to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against HubSpot's own documentation, at HubSpot knowledge base. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.