What DNS records does HubSpot email authentication need?

DKIM is two CNAME records at hs1- ._domainkey. and hs2- ._domainkey pointing to your account's keys on hubspotemail.net. SPF is an account-specific include merged into your existing SPF record: include: .spfNN.hubspotemail.net — HubSpot calls this highly recommended (an allowlist). DMARC is your single TXT record at _dmarc. Copy hosts and targets from HubSpot's setup screen; the account ID inside them makes every portal's records unique. HubSpot's troubleshooting material also mentions an MX among the connection's record types but does not document its value for the standard wizard; publish what your own setup screen lists.

Does HubSpot mail align for DMARC?

Yes — through DKIM. On HubSpot's shared network the envelope return-path remains HubSpot's domain, and HubSpot's own glossary states the return-path cannot be customized by senders on the shared network; HubSpot says SPF for the return-path is already configured on its side. The practical consequence: SPF authenticates but does not align with your From domain, so DMARC passes on the strength of aligned DKIM, whose d= equals your connected From domain. HubSpot's DMARC guidance instructs that adkim and aspf should both be set to r (relaxed alignment). A branded return-path subdomain exists only in the dedicated-IP or transactional add-on flow, which publishes its own A, MX, SPF and DKIM records.

Can HubSpot Support set up my DMARC record?

No — HubSpot states the boundary itself: 'HubSpot Support cannot help with DMARC record setup.' HubSpot documents what the record must contain (a single record, lowercase policy values, mailto: reporting addresses, relaxed alignment) but the record is yours to publish at your DNS host. Our rollout guide covers the phased none-to-reject climb once HubSpot's authentication is live.

HubSpot · Email sending domain

Connect a HubSpot email sending domain — DKIM first, honestly about SPF

First published 20 October 2026 · From HubSpot's Knowledge Base (seven articles, read in full for this guide). Two corrections to common instructions up front: the settings path is now Settings → Content → Domains & URLs (older guides say Marketing → Email), and a sending subdomain is HubSpot's recommendation — the root is allowed when it isn't hosting your site.

Do not fix the wrong thing first. HubSpot has five different things called “connecting a domain” (website hosting, brand domain, email sending, dedicated IP, redirect) sharing one settings screen. Connecting the wrong one authenticates nothing. This guide is the email sending domain — the one whose records are DKIM CNAMEs.

The records

Record	What yours will look like (shape — values from your screen)
DKIM CNAME ×2	Hosts `hs1-<accountID>._domainkey.<domain>` and `hs2-<accountID>._domainkey.<domain>` → targets on `hubspotemail.net` (your domain rendered with hyphens, e.g. `example-com.hs1a.dkim.hubspotemail.net`)
SPF (merge)	Add `include:<accountID>.spfNN.hubspotemail.net` into your existing SPF record — HubSpot calls it “highly recommended.” Never a second SPF record (our merge guide)
DMARC	Your single TXT at `_dmarc` — published by you (HubSpot Support explicitly can't), per the rules in §4

The ladder

Choose the sending (sub)domain. Recommended: a dedicated subdomain (e.g. email./em.) so marketing sending never entangles your corporate mail's reputation; root permitted if it isn't hosting. Decide deliberately — changing later means a fresh connection and fresh records.
Settings → Content → Domains & URLs → Connect a domain → Email sending.
Publish the records the wizard shows (table above) at your DNS host.
Wait and watch the status — HubSpot verifies against DNS; propagation, not effort, is the variable. Use a lookup on the exact CNAME hosts if it stalls.
DMARC: ensure your record exists, single, with relaxed alignment (below).
Test like a receiver: send to a Gmail address, open “Show original” — you want dkim=pass with your domain and DMARC pass. SPF will show pass against HubSpot's return-path — expected; read §4 before “fixing” it.

Alignment truth — in HubSpot's own words

HubSpot, on SPF: “SPF is traditionally required for the envelope return path domain… HubSpot already has this configured for marketing emails sent through its shared servers.” Its glossary adds that the return-path “cannot be customized by senders on HubSpot's shared network.”
Translation, without extrapolation: on shared sending, SPF authenticates HubSpot's return-path, not your From — so SPF alignment isn't available there, and DMARC passes on aligned DKIM (d= = your connected domain). That's a sound architecture, and it's why §3's DKIM records are the whole game.
The branded return-path exists — in the dedicated-IP / transactional add-on flow, with its own generated subdomain (e.g. 12345m.example.com) and A + MX (priority 0) + SPF + DKIM records. Don't go hunting for it in the standard wizard.
HubSpot on DMARC alignment modes: adkim/aspf “should both be set to r (relaxed alignment)” — consistent with everything this series teaches (strict SPF alignment breaks against subdomain return-paths across ESPs; see SendGrid and SES).
HubSpot's own stakes statement is qualitative: bulk senders must fully set up DMARC/DKIM/SPF or face DMARC/policy bounces at Gmail/Yahoo. (For the actual thresholds, our Yahoo guide quotes the receivers themselves.)

Traps

Trap	Reality
“Fixing” the SPF alignment you saw in the test	On shared sending there is nothing to fix — alignment via SPF isn't offered; DKIM carries it. Chasing it leads people to delete the include (breaking SPF authentication) or invent return-path records.
Connecting the domain in the wrong portal / as the wrong type	Sending domains may be connected to multiple HubSpot accounts per current KB — but a hosting domain is exclusive. If connect fails, check which of the five types you actually picked.
Following an old guide's menu path	Settings moved (Content → Domains & URLs). Also quarantine one stray: a HubSpot troubleshooter references `include:shared.hubspot.com` — the account-specific include from your wizard is the documented pattern; prefer your screen.
Expecting HubSpot Support to publish DMARC for you	Their sentence is final: they can't. Your DNS host + this series' rollout guide is the path.
Root-domain CNAME collisions	If your root already carries records the wizard wants to own (or your host flattens CNAMEs), the subdomain route isn't just recommended — it's the exit. Another reason rung 1 exists.

FAQ

My KB-saved screenshot shows an MX in the wizard. Publish it?

HubSpot's KB headlines “four record types” yet documents no MX value for the standard flow in the text we could verify — so: publish what your wizard lists, verbatim, and nothing reconstructed from articles (ours included).

Sales emails from reps — same setup?

Different pipe: one-to-one mail rides your connected inbox (Google/Microsoft) and inherits that platform's authentication. HubSpot's sending-domain connection governs HubSpot-sent marketing/automated mail.

We rebranded domains. Reconnect?

A new sending domain is a new connection with new CNAMEs; the old domain's records can retire only after no live sending uses it (check both marketing and any transactional add-on).

Sources

HubSpot Knowledge Base — Manage your email authentication, Overview of email authentication (incl. its glossary), Understand email sending in HubSpot, Connect a dedicated IP, Connect a domain to HubSpot, Troubleshoot domain connection, Troubleshoot email authentication issues.

Verification note: record shapes, the return-path position and the relaxed-alignment instruction were confirmed from HubSpot's KB on 20 October 2026. Two KB inconsistencies found during research (a stray legacy SPF include in a troubleshooter; the undocumented standard-flow MX) are flagged in-line rather than resolved by guesswork.

Did this guide work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.