HubSpot SSL DNS Setup Guide for Secure Domains

When you change SSL settings in HubSpot for a connected domain, you must update your DNS records correctly to keep your site secure and avoid downtime. This guide walks you through what changes trigger DNS updates, how to read the SSL status messages, and the exact steps to fix common SSL and DNS issues.

When HubSpot Requires DNS Updates for SSL

Certain actions in your domain settings can cause HubSpot to regenerate SSL certificates and require new DNS values. Understanding these triggers helps you plan updates and avoid interruptions.

• Adding a new subdomain or root domain
• Connecting a new brand domain for hosting
• Changing primary or secondary domains
• Modifying domain redirect rules
• Turning SSL on or off for a domain

After these changes, HubSpot may show alerts that your DNS records must be updated for SSL to renew or to finish provisioning on new domains.

How HubSpot Indicates DNS Problems for SSL

In your domain settings, HubSpot displays clear status indicators when SSL is waiting, successful, or blocked. These messages guide you toward the correct DNS fix.

Typical SSL status messages in HubSpot

• SSL pending – HubSpot is requesting or renewing certificates and may be waiting on DNS changes.
• SSL provisioning error – DNS records do not match the required configuration.
• Domain not secure – The certificate could not be issued or renewed.

Each status usually comes with a short explanation. Use it to decide whether you must add or modify CNAME, A, or TXT records at your DNS host.

Finding the Correct DNS Records in HubSpot

To correct SSL issues, you need the exact DNS values generated by HubSpot for each domain.

1. Log in to your account.
2. Navigate to your settings and open the Domains & URLs section.
3. Locate the domain with an SSL or DNS alert.
4. Click to expand the domain details and view required DNS records.

HubSpot lists each record type, host name, and value you must add or update at your DNS provider. Copy these values exactly as shown.

Types of DNS records used by HubSpot SSL

• CNAME records – Common for subdomains and verification.
• A records – Used for some root domains.
• TXT records – Sometimes required for verification and ownership.

Always compare the current records at your DNS host to the values shown in HubSpot. Any mismatch can block SSL provisioning or renewal.

Step-by-Step: Update DNS Records for HubSpot SSL

Follow this general workflow to resolve SSL-related DNS issues after a change in your HubSpot domain settings.

1. Identify the domain with SSL errors

   Open the Domains & URLs page and look for any warning icons or messages. Select that domain to see details.

2. Review the required records from HubSpot

   Copy the host and value for each record exactly as displayed. Note which are new and which replace existing DNS entries.

3. Sign in to your DNS provider

   This is usually your domain registrar or a dedicated DNS platform. Open the DNS management area for the affected domain.

4. Add or edit CNAME records

   If HubSpot requires a CNAME, either create a new record or update the existing matching host to use the value provided. Save your changes before moving on.

5. Update A records if needed

   When an A record is listed, adjust the IP address so that it matches the HubSpot value exactly. Remove any conflicting or outdated A records that point elsewhere.

6. Add TXT records for verification

   If a TXT record is listed, create or update it with the string supplied by HubSpot. This step is critical for ownership and SSL validation.

7. Wait for DNS propagation

   DNS changes can take time. In many cases, HubSpot will detect updates within minutes, but full propagation can require several hours depending on your TTL settings.

8. Confirm SSL status in HubSpot

   Return to the domain settings and check the SSL status. Once DNS records are correct, SSL should move from pending or error to a secure, active state.

Common HubSpot SSL DNS Errors and Fixes

Some issues appear frequently when DNS changes are incomplete or incorrect. Use these tips to troubleshoot.

SSL stuck in pending state in HubSpot

• Check that all required records exist.
• Verify there are no extra conflicting CNAME or A records for the same host.
• Allow more time for DNS propagation before retrying.

Provisioning error due to DNS mismatch

• Ensure each host value exactly matches the string from HubSpot.
• Remove outdated or duplicate records set up for legacy systems.
• Confirm that you are editing DNS for the correct domain zone.

Domain not secure after SSL renewal

• Look for expired or removed verification records.
• Re-add any verification TXT or CNAME records requested by HubSpot.
• Re-run the check from the domain settings page once DNS is updated.

Best Practices for Managing HubSpot Domains and SSL

Careful planning reduces the risk of SSL downtime when you reconnect or update domains for hosting.

• Document all DNS changes you make at your provider.
• Lower TTL values temporarily before major changes, if possible.
• Update nonproduction or test domains first to validate your steps.
• Coordinate DNS updates during off-peak traffic times.

Also consider creating internal procedures so your team consistently refers to HubSpot for the latest record values instead of relying on screenshots or old notes.

Where to Find the Original HubSpot SSL DNS Instructions

For the official, most current instructions, always review the documentation provided directly by the platform. You can access the original guidance on updating DNS records for SSL changes in HubSpot at this HubSpot help article. That page may include updated screenshots, provider-specific tips, and new record types as the product evolves.

Get Extra Help With HubSpot DNS and Strategy

If you need assistance beyond basic DNS updates, such as planning domain strategy, redirects, and SEO-safe migrations, you can work with a specialist agency. For example, Consultevo offers consulting and implementation support for complex setups that rely on HubSpot and other platforms.

By regularly checking your domain status, following the SSL prompts in your account, and keeping DNS records aligned with the values provided by HubSpot, you can maintain a secure, reliable website experience with minimal interruptions.

Need Help With Hubspot?

If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.

Scale Hubspot

“`