Email senders · HubSpot

How do I set up HubSpot so its email passes DMARC?

Publish the records HubSpot shows in your account for your domain.

Last read from the sources at the foot of this page.

Check my firm
01

What does HubSpot ask me to publish?

You can connect your email sending domain to HubSpot to ensure your marketing emails comply with the authentication standards and sending policies enforced by major email inbox providers. During the connection process, you will set up four separate DNS record types: MX, DKIM, SPF, and DMARC.

HubSpot makes the values for your account, so we do not print any here.

HubSpot also gives MX records, for the replies and bounces it receives. Add them only at the name HubSpot shows you, never at your domain itself: the MX records at your domain decide where all of your email is delivered.

02

Where in HubSpot are my values shown?

In your HubSpot account, click the settings icon in the top navigation bar. In the left sidebar menu, navigate to Content > Domains & URLs. Click the Email Sending tab.

In HubSpot, click the settings icon, go to Content, then Domains & URLs, and open the Email Sending tab.

Copy each value from there exactly as shown, and add each record at your DNS host.

03

How do I add HubSpot to the SPF record I already have?

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".

Add the include HubSpot shows you inside the one SPF record you have, before its last word, and keep every service already in it. Never add a second SPF record: two make the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10, the check fails, so remove services you no longer use before you add a new one.

04

Will p=reject block HubSpot email?

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment

Not once HubSpot signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records HubSpot gives you are on your domain.

HubSpot has you publish a DMARC record on the sending domain as part of connecting it.

A subdomain counts as authenticated when a DMARC record is set at the root domain, because the policy is inherited.

If you already have an SPF record, HubSpot is added to that record, not published as a second one.

HubSpot also asks that your domain has a DMARC record. A domain has one DMARC record: if you have one, keep it and do not add another.

Before you raise your policy, read your DMARC reports and check that email from HubSpot passes.

Sources

Where does this come from?

Related
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy