DMARC email setup with HubSpot is not just a matter of publishing one TXT record. The reliable approach is to identify every system that sends mail for your domain, authenticate HubSpot with DKIM, confirm SPF coverage where it is needed, and then use DMARC reports to decide when enforcement is safe.
For most HubSpot sending configurations, DKIM is the central path to DMARC alignment. SPF still matters, but DMARC does not require both SPF and DKIM to pass. A message can pass DMARC when either SPF or DKIM passes and aligns with the visible From domain. That distinction is important when HubSpot sends through its own infrastructure while other platforms use the same business domain.
Start with monitoring rather than immediately using a strict reject policy. Treat DMARC as an operating control for your email domain: first establish which traffic is legitimate, then correct ownership and authentication gaps, and only then increase enforcement.
What DMARC does when HubSpot sends your email
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It gives receiving mail systems a way to evaluate whether an email claiming to come from your domain is authenticated and aligned with the domain shown in the From address.
DMARC builds on two underlying mechanisms:
- SPF checks whether the sending infrastructure is authorized for the envelope sender domain.
- DKIM checks whether the message carries a valid cryptographic signature associated with a domain.
- Alignment checks whether the authenticated domain relates correctly to the visible From domain.
DMARC passes when at least one of SPF or DKIM both passes and aligns. This is why a correctly configured HubSpot DKIM setup can support DMARC even when SPF alignment is not the path used for a particular message.
A DMARC record defines the receiving policy, but it does not authenticate email by itself. Authentication comes from the sending systems and the DNS records that support them.
Before changing DNS, map every legitimate sender
The most common implementation mistake is configuring HubSpot in isolation. Your domain may also be used by a CRM, transactional application, customer support platform, billing system, recruiting tool, event platform or office email service. A DMARC policy applies to the domain, not only to HubSpot campaigns.
Create a sender inventory before publishing a stronger policy. For each system, record the business owner, sending purpose, visible From address, envelope sender where known, authentication method and whether it should still be active. This turns DMARC from a DNS task into an ownership task.
- List every platform that sends mail using your root domain or a sending subdomain.
- Separate marketing, transactional, operational and employee email streams.
- Identify the owner responsible for correcting each authentication failure.
- Remove abandoned services and old DNS records where appropriate.
- Confirm which From domains recipients actually see.
A useful diagnostic question is: if this sender failed tomorrow, who would know whether the traffic was legitimate? If nobody can answer, the domain is not ready for strict DMARC enforcement.
Configure HubSpot authentication in the correct order
HubSpot provides domain authentication settings that generate the DNS records required for its email sending configuration. The exact record values and record types should be taken from the current HubSpot account because they are specific to the portal and domain setup.
- Choose the sending domain. Decide whether HubSpot should send from your primary domain or a dedicated subdomain. A separate subdomain can make ownership and reporting clearer, especially when marketing and transactional traffic have different teams.
- Open HubSpot’s domain authentication settings. Use the records shown for the selected sending domain rather than copying values from another portal or an old setup.
- Publish the supplied DNS records. Add them at the authoritative DNS provider. Do not place records in a secondary DNS system that is not authoritative for the domain.
- Verify the connection in HubSpot. DNS changes can take time to become visible. Confirm that HubSpot reports the domain as connected and authenticated.
- Send a controlled test. Check the received message headers and confirm that the DKIM signature validates and that the signing domain aligns with the From domain.
Do not assume that a green status inside HubSpot proves that all DMARC conditions are correct. The receiving mailbox’s authentication results are the operational evidence. A test should be performed from the same sending domain and message type that will be used in production.
A domain can be connected in HubSpot while another sender using the same domain remains unauthenticated. Domain authentication is a shared operating responsibility, not a single application setting.
SPF and HubSpot: what the record should and should not do
SPF authorizes mail servers for a domain used in the SMTP envelope. It does not validate the friendly From name or address by itself. This distinction explains why adding a provider to SPF does not automatically guarantee DMARC alignment.
Maintain one SPF record for each domain. If several providers send mail, consolidate their authorized mechanisms into that record rather than publishing competing SPF records. Multiple SPF records can cause SPF evaluation to fail. Also keep the DNS lookup count within the SPF limit, and remove services that no longer send mail.
HubSpot may not need its own IP addresses added to your SPF record for DMARC to pass if HubSpot’s DKIM signature is valid and aligned. That does not mean SPF can be ignored. Other systems may depend on it, and SPF can still provide a second authentication path for eligible messages.
SPF lists the visible From domain
SPF evaluates the envelope sender and authorized sending infrastructure. The address displayed to the recipient is not the whole SPF decision.
DKIM provides an aligned path
When HubSpot DKIM is valid and aligned with the visible From domain, it can satisfy the DMARC authentication requirement even when SPF alignment is not used.
DKIM alignment is usually the key HubSpot control
DKIM adds a signature to outgoing messages. The receiving mail system uses a public key published in DNS to verify that the message was signed by the expected service and has not been altered in transit.
For DMARC, a valid DKIM signature is only part of the test. The domain in the signature must also align with the domain in the visible From address according to the domain alignment mode in use. A signature from an unrelated provider domain may be valid but still fail DMARC alignment.
When troubleshooting, inspect authentication results rather than relying on a campaign dashboard alone. Look for the DKIM result, the signing domain, the From domain and the DMARC result. If the DKIM signature passes but DMARC fails, alignment is one of the first things to investigate.
A valid DKIM signature is not automatically a valid DMARC result. The authenticated domain must also have the required relationship to the visible From domain.
Choose a DMARC policy based on evidence
The policy in the DMARC TXT record tells receiving systems what to do when a message fails DMARC. The main policy values are:
- p=none requests monitoring without asking receivers to quarantine or reject failing messages.
- p=quarantine asks receivers to treat failing messages as suspicious, commonly by placing them in spam, although receiver behavior can vary.
- p=reject asks receivers not to accept failing messages.
Use p=none as an observation phase, not as the final definition of success. Review aggregate reports and investigate every expected sender. Reports may reveal forgotten applications, forwarding paths, third-party services or unauthorized use of the domain.
Move toward quarantine or reject only when the business has evidence that legitimate sending paths are covered. The right question is not whether HubSpot passes. It is whether every legitimate sender using the policy domain passes or has an intentional exception and an accountable owner.
A practical sequence for implementing DMARC with HubSpot
Example: separating marketing and operational mail
Imagine a company that sends campaigns through HubSpot, invoices through an application and support notifications through a service desk. All three use the same parent domain in their From addresses. HubSpot’s DKIM is configured correctly, but the application has no aligned authentication and the service desk still uses an old sending configuration.
Publishing reject immediately could affect legitimate invoices or support messages. A better sequence is to authenticate HubSpot, inventory the other systems, review DMARC reports and decide whether the application and service desk should use dedicated subdomains. Each sending stream then has a clearer owner, a narrower DNS configuration and a more useful reporting boundary.
This is a hypothetical example, but the operating principle is broadly useful: separate systems when their ownership, risk or authentication lifecycle is materially different.
Troubleshoot DMARC failures methodically
When HubSpot email appears to fail DMARC, avoid changing several records at once. Start with the message headers and identify which mechanism failed.
- DKIM fails: check that the HubSpot DNS records are present, unchanged and published at the authoritative provider.
- DKIM passes but alignment fails: compare the DKIM signing domain with the visible From domain and review the domain configuration in HubSpot.
- SPF fails: inspect the envelope sender, the SPF record and the complete list of authorized services. Check for duplicate records or too many DNS lookups.
- DMARC fails after forwarding: examine whether forwarding or message rewriting changed the authentication results. Forwarding can create legitimate-looking failures that require careful interpretation.
- Only one stream fails: isolate the sending platform and its owner instead of weakening the policy for the entire domain.
If enforcement causes a business-critical message to be rejected, a temporary policy adjustment may be appropriate while the root cause is fixed. Treat that as an incident response step, not a permanent operating model.
Make DMARC part of domain operations
DMARC becomes more reliable when it has a recurring owner and a change process. Add email authentication checks to the review process for new software, acquisitions, rebrands, domain changes and marketing platform migrations.
At minimum, review whether new senders are documented, whether DNS records still represent active services, whether report destinations are monitored and whether a change in the visible From domain will affect alignment.
If HubSpot is part of a wider CRM or marketing operation, the sending configuration should be documented alongside ownership, data flows and campaign processes. ConsultEvo’s HubSpot consulting services can support portal configuration, while CRM consulting services can help connect email operations to broader ownership and reporting processes.
Email authentication is successful when the business can explain every legitimate sender, every important failure and every decision to enforce or defer policy.
More DNS records or more email tools do not automatically create better deliverability. A process-first setup creates a clear relationship between sending systems, domain ownership, authentication evidence and the business decision that follows from each report.
Frequently asked questions
Does HubSpot need to be added to the SPF record for DMARC to pass?
Not necessarily. DMARC can pass through aligned DKIM even when SPF is not the passing mechanism for HubSpot. Review the actual message headers and keep SPF accurate for all systems that require it.
What DNS records does HubSpot require for email authentication?
HubSpot provides domain-specific authentication records in its settings. Publish the current records shown in the relevant HubSpot portal, then verify the domain and test a real message. Do not reuse records from another account or an old configuration.
Should a domain using HubSpot start with p=reject?
Usually, start with p=none while you inventory senders and review reports. Move to quarantine or reject only after legitimate traffic is understood and authentication or alignment issues have been addressed.
Why can DKIM pass while DMARC fails?
DKIM can pass while DMARC fails if the signing domain is not aligned with the visible From domain. DMARC evaluates both authentication and alignment.
What is the biggest operational risk when setting up DMARC with HubSpot?
The biggest risk is treating HubSpot as the only sender. Other legitimate systems may use the same domain, so strict enforcement without a complete sender inventory can disrupt important email.
Bring email authentication into a clearer operating model
If HubSpot, CRM and other sending systems are difficult to govern together, ConsultEvo can help map ownership, clarify the process and configure a more reliable operating system.
