Fix guide

How to Fix DMARC Alignment for HubSpot

Wire HubSpot’s custom sending domain in settings, then drop their DKIM CNAMEs in your zone — alignment follows.

Why HubSpot trips DMARC

Marketing sends from HubSpot’s pool until you connect a custom domain — add their CNAMEs and fix SPF so DKIM aligns with From:.

Exact DNS records

HubSpot shows two DKIM CNAMEs per domain. SPF typically uses an include such as include:servers.mcsv.net — confirm the current value in HubSpot documentation.

(Copy exact CNAME hostnames and targets from HubSpot → Sending domains) hubspot._domainkey.yourdomain.com → CNAME → … (per HubSpot UI) second._domainkey record as shown in HubSpot

Step-by-step fix

Step 1 HubSpot → Settings → find Domains / Sending domains (path may vary by hub)

Step 2 Add your domain and start the authentication flow

Step 3 Copy the two CNAME records HubSpot provides for DKIM

Step 4 Ensure SPF includes HubSpot's sending range — verify current value in HubSpot docs

Step 5 Wait for HubSpot to verify DNS — can take up to 48 hours

Step 6 Run DNS Preflight to confirm DKIM and alignment

Run your domain through DNS Preflight

Open DNS Preflight →

Related glossary: DMARC · DMARC alignment · DKIM · SPF record

FAQ

What are the HubSpot DMARC alignment setup steps?

Connect a sending domain in HubSpot, add the provided DKIM CNAME records to DNS, ensure SPF includes HubSpot's servers, then verify in HubSpot.

Why does HubSpot email fail DMARC?

Usually missing or incorrect DKIM CNAMEs, or SPF that does not authorize HubSpot sending for your domain.

How do I verify HubSpot DNS authentication?

HubSpot shows verification status in settings. Cross-check with DNS Preflight for public DNS visibility.

What SPF include does HubSpot use?

HubSpot documents the current SPF include — check HubSpot knowledge base for include:servers.mcsv.net or updated values.

Does HubSpot support DMARC p=reject?

Yes when DKIM and SPF alignment pass. Roll out gradually and monitor DMARC aggregate reports.

← All DMARC fix guides

Open DNS Preflight and re-check your zone →