Fix guide

How to Fix DMARC Alignment for HubSpot

HubSpot email alignment requires connecting a custom sending domain in HubSpot settings and adding CNAME records to your DNS for DKIM signing.

Why alignment fails

Without authenticated sending, HubSpot may not align DKIM with your From: domain. You need the dashboard-provided CNAMEs plus a correct SPF include.

Exact DNS records

HubSpot shows two DKIM CNAMEs per domain. SPF typically uses an include such as include:servers.mcsv.net — confirm the current value in HubSpot documentation.

(Copy exact CNAME hostnames and targets from HubSpot → Sending domains) hubspot._domainkey.yourdomain.com → CNAME → … (per HubSpot UI) second._domainkey record as shown in HubSpot

Step-by-step fix

Step 1 HubSpot → Settings → find Domains / Sending domains (path may vary by hub)

Step 2 Add your domain and start the authentication flow

Step 3 Copy the two CNAME records HubSpot provides for DKIM

Step 4 Ensure SPF includes HubSpot's sending range — verify current value in HubSpot docs

Step 5 Wait for HubSpot to verify DNS — can take up to 48 hours

Step 6 Run DNS Preflight to confirm DKIM and alignment

Verify alignment and DNS in your browser

Open DNS Preflight →

Related glossary: DMARC · DMARC alignment · DKIM · SPF record

FAQ

What are the HubSpot DMARC alignment setup steps?

Connect a sending domain in HubSpot, add the provided DKIM CNAME records to DNS, ensure SPF includes HubSpot's servers, then verify in HubSpot.

Why does HubSpot email fail DMARC?

Usually missing or incorrect DKIM CNAMEs, or SPF that does not authorize HubSpot sending for your domain.

How do I verify HubSpot DNS authentication?

HubSpot shows verification status in settings. Cross-check with DNS Preflight for public DNS visibility.

What SPF include does HubSpot use?

HubSpot documents the current SPF include — check HubSpot knowledge base for include:servers.mcsv.net or updated values.

Does HubSpot support DMARC p=reject?

Yes when DKIM and SPF alignment pass. Roll out gradually and monitor DMARC aggregate reports.

← All DMARC fix guides

Run checks on domainpreflight.dev →