DMARC email setup with HubSpot

Configuring DMARC alongside your email tools can be confusing, especially when you are sending marketing email through HubSpot and authenticating your domain somewhere else. This guide explains how DMARC works with HubSpot and what you need to configure so your messages authenticate correctly and reach the inbox.

How DMARC works with HubSpot email sending

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to tell receiving mail servers how to handle messages that fail authentication. When you send email through HubSpot using your own domain, DMARC checks look at:

• Whether the message passes SPF and aligns with your visible From domain.
• Whether the message passes DKIM and aligns with your visible From domain.
• What DMARC policy (p=none, quarantine, reject) your domain publishes.

Because HubSpot supports DKIM and SPF alignment, properly configured records allow your marketing email to pass DMARC checks as long as you publish a compatible policy.

Prerequisites before configuring DMARC for HubSpot

Before you create or tighten a DMARC record, make sure your domain is correctly authenticated for email sending. When using HubSpot, that typically includes:

• An SPF record that authorizes all services sending on behalf of your domain.
• DKIM records added to your DNS for each sending platform.
• Verification that your email-sending domain is correctly connected inside your HubSpot settings.

If multiple providers send email using your domain, you must account for each one in SPF and DKIM so DMARC does not block legitimate messages.

SPF considerations when you use HubSpot

SPF checks whether the sending server is authorized to send for your domain. When you send email through HubSpot, the SPF evaluation depends on the envelope sender domain, not just the friendly From address your contacts see.

Key points about SPF and HubSpot:

• HubSpot sends mail from its own infrastructure, so your SPF record does not need to list its IPs if alignment is based on DKIM rather than SPF.
• If another service sends transactional or operational email from your domain, that service must be included in your SPF record.
• DMARC can pass when either SPF or DKIM aligns, so a strong DKIM configuration with HubSpot is usually sufficient.

Keep your SPF record under the DNS lookup limit, and avoid adding unnecessary include mechanisms for systems that no longer send mail.

How HubSpot uses DKIM for DMARC alignment

DKIM signs each message using a private key and a selector stored in your DNS as a public key. For DMARC, the important piece is that the DKIM d= domain aligns with your visible From domain.

When you configure DKIM for HubSpot:

• You add CNAME or TXT records in your DNS, pointing to selectors provided inside your portal.
• HubSpot uses those records to sign outgoing email with a DKIM signature that aligns with your sending domain.
• Receiving servers can then validate the signature, improving trust and supporting DMARC alignment.

This alignment allows your messages to pass DMARC based on DKIM, even if SPF alignment is not configured for HubSpot.

Choosing a DMARC policy while sending from HubSpot

Your DMARC policy determines what happens when a message fails authentication and alignment checks. The main options are:

• p=none – Monitor only; do not block or quarantine messages.
• p=quarantine – Send failing messages to spam or a similar folder.
• p=reject – Instruct receivers to reject failing messages entirely.

When you first implement DMARC on a domain used by HubSpot, it is best to start with p=none so you can review reports and verify that your SPF and DKIM alignment work correctly for all your sending systems.

Step-by-step: Implementing DMARC with HubSpot

1. Audit your senders

   List every platform that sends email using your domain, including HubSpot, CRM systems, support tools, and application servers.

2. Confirm SPF and DKIM settings

   Verify each sender is covered by SPF and has working DKIM keys. For HubSpot, confirm DKIM is fully connected and verified in your domain settings.

3. Create an initial DMARC record

   Add a TXT record at _dmarc.yourdomain.com similar to:
   v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; fo=1;

4. Monitor reports

   Review aggregate reports to ensure legitimate HubSpot email passes DMARC and to identify any unauthorized senders.

5. Gradually increase enforcement

   Once you confirm that all legitimate traffic, including HubSpot messages, passes DMARC, move to p=quarantine, monitor impact, then consider p=reject.

Troubleshooting DMARC failures involving HubSpot

If recipients report bounced or missing messages after you enforce DMARC, investigate:

• Whether DKIM for HubSpot is correctly configured and still validating.
• Whether another system is rewriting headers or forwarding, which can break alignment.
• Whether your DMARC policy is too strict for your current configuration.

You can temporarily roll back from p=reject to p=quarantine or p=none while you troubleshoot, then reapply a stronger policy once issues are resolved.

Best practices for domains sending via HubSpot

To keep your email program healthy while using DMARC and HubSpot together, follow these best practices:

• Maintain a single, clean SPF record for your root domain.
• Rotate DKIM keys on a regular schedule for security.
• Use subdomains for different sending streams when appropriate.
• Monitor DMARC reports continuously for unexpected behavior.

These practices help protect your brand against spoofing and improve the reliability of your marketing email campaigns.

Where to learn more about DMARC and HubSpot

For a detailed breakdown of how DMARC interacts with authentication settings, review the official HubSpot knowledge base article on DMARC policies: DMARC policy and HubSpot guide.

If you need strategic help implementing authentication across complex stacks, you can also work with an optimization and consulting partner such as Consultevo, which focuses on email performance, CRM configuration, and technical SEO.

With correctly aligned SPF, DKIM, and DMARC, your domain will be better protected, and marketing email sent via HubSpot will have a stronger chance of landing in the inbox instead of spam.

Need Help With Hubspot?

If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.

Scale Hubspot

“`