Understanding HubSpot Email Authentication
HubSpot requires domain authentication using portal-specific CNAME records for DKIM and a unique SPF include host based on your Hub ID.
When HubSpot delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting HubSpot's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for HubSpot
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:[id].spf01.hubspotemail.net ~all | 3600 | Portal-specific SPF. |
Step-by-Step Setup Instructions
In HubSpot > Settings > Domains & URLs > Connect email sending domain.
Add the 2 DKIM CNAME records and SPF include to your DNS.
Verify in HubSpot.
Common HubSpot SPF Configuration Mistakes
× Generic include:hubspot.com used
Cause: Outdated SPF string.
Fix: Use portal-specific include.
Frequently Asked Questions
How do I find my HubSpot SPF string?
In HubSpot Settings > Domains & URLs > Email Sending Domains.