DMARC for marketing platforms
How do I set up DMARC for HubSpot?
HubSpot asks for two DKIM CNAME records and an SPF TXT entry, all generated for your account during setup, plus a DMARC TXT record.
The DNS records for HubSpot
SPF: Added to your existing SPF TXT record
include:<value from the Required data column>HubSpot's sample is v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all. The number is an example; yours comes from setup. v=spf1 and -all should each appear only once.
DKIM selector: Generated by HubSpot during setup
two CNAME records (Host and Required data columns in HubSpot)HubSpot's troubleshooting step for one kind of check uses the selector smtpapi. For your own records, use the selector in the host HubSpot gave you.
DMARC
_dmarc TXT (one record per domain)Values in angle brackets are specific to your account. Copy the real ones from HubSpot rather than from this page.
Alignment caveats
- ✓Add HubSpot to your existing SPF record. Publishing a second SPF record breaks SPF for the domain.
- ✓HubSpot notes a subdomain counts as covered when the root domain has a DMARC record, because of inheritance. That also means a root p=reject applies to a HubSpot subdomain.
From p=none to p=reject with HubSpot
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Before enforcing at the root, check every HubSpot sending subdomain in your reports, because the policy reaches them unless you set sp=.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from HubSpot's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how HubSpot really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does HubSpot need?
include:<value from the Required data column>, published as: Added to your existing SPF TXT record. HubSpot's sample is v=spf1 include:anotherprovider.com include:123456.spf03.hubspotemail.net -all. The number is an example; yours comes from setup. v=spf1 and -all should each appear only once.
What DKIM selector does HubSpot use?
Generated by HubSpot during setup. HubSpot's troubleshooting step for one kind of check uses the selector smtpapi. For your own records, use the selector in the host HubSpot gave you.
Will HubSpot mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Add HubSpot to your existing SPF record. Publishing a second SPF record breaks SPF for the domain.
How do I reach p=reject with HubSpot?
Start at p=none with a rua address, finish the HubSpot setup, then read your reports. Before enforcing at the root, check every HubSpot sending subdomain in your reports, because the policy reaches them unless you set sp=. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
