Understanding HubSpot Email Authentication
HubSpot requires domain authentication using portal-specific CNAME records for DKIM and a unique SPF include host based on your Hub ID.
When HubSpot delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting HubSpot's IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for HubSpot
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:[id].spf01.hubspotemail.net ~all | 3600 | Portal-specific SPF. |
Step-by-Step Setup Instructions
In HubSpot > Settings > Domains & URLs > Connect email sending domain.
Add the 2 DKIM CNAME records and SPF include to your DNS.
Verify in HubSpot.
Common HubSpot SPF Configuration Mistakes
× Generic include:hubspot.com used
Cause: Outdated SPF string.
Fix: Use portal-specific include.
Frequently Asked Questions
How do I find my HubSpot SPF string?
In HubSpot Settings > Domains & URLs > Email Sending Domains.
Why is HubSpot's SPF include unique per portal?
HubSpot generates a portal-specific SPF include (e.g. include:123456.spf01.hubspotemail.net) based on your Hub ID. This unique include maps to dedicated sending infrastructure assigned to your account, isolating your sending reputation from other HubSpot customers.
What DKIM records does HubSpot require?
HubSpot requires two portal-specific CNAME DKIM records: hs1-[portalId]._domainkey and hs2-[portalId]._domainkey. The [portalId] is your numeric HubSpot portal ID found in Settings > Account Setup > Account.
What happens if I use include:hubspot.com in SPF instead of the portal-specific include?
The generic include:hubspot.com is deprecated and no longer reflects HubSpot's sending infrastructure. Using it will cause SPF PermError or SoftFail for your HubSpot emails, resulting in DMARC alignment failures and deliverability problems.
Does HubSpot support full DMARC p=reject with custom domains?
Yes. Once your portal-specific SPF include and two DKIM CNAME records are verified in HubSpot, all HubSpot-sent emails align with your From: domain under SPF and DKIM. This satisfies DMARC p=reject enforcement.
Can I send marketing emails from @gmail.com or @yahoo.com with HubSpot?
No. Google and Yahoo's 2024 bulk sender requirements prohibit sending bulk email from free webmail provider domains. HubSpot requires you to verify a custom business domain and authenticate it with SPF and DKIM before sending to large lists.