HubSpot Custom Domain Email Authentication and DMARC Integration

Proper hubspot dmarc record setup is essential for ensuring your marketing and transactional emails reach the inbox instead of the spam folder, while protecting your brand from spoofing. When sending emails through HubSpot using your own custom domain, mailbox providers require strict authentication via Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Without these records correctly configured, receiving servers may flag or reject your campaigns.

To jumpstart your configuration safely, you can use the DMARC Record Generator to build a custom TXT policy tailored to your exact monitoring or enforcement requirements. In this comprehensive guide, we will walk through the prerequisites, exact DNS record syntax, step-by-step instructions for popular hosting providers, troubleshooting tips, and a final deployment checklist.

Understanding HubSpot Email Authentication Architecture

Before publishing your DMARC record, you must understand how HubSpot handles email sending authentication. HubSpot relies on three core components: your sending domain, SPF, and DKIM (specifically, CNAME-based DKIM alignment).

The Role of SPF, DKIM, and DMARC

• SPF (Sender Policy Framework): Publishes a list of authorized IP addresses and servers allowed to send email on behalf of your domain. In HubSpot, this is achieved by adding a CNAME record that points to HubSpot's designated return-path servers.
• DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to the headers of your outgoing emails. HubSpot utilizes custom DKIM via CNAME records (often referred to as 'branding' your email sending domain in HubSpot) so that the From address domain aligns with the signing domain.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): A DNS-based policy framework that uses SPF and DKIM to determine the authenticity of an email message. It instructs receiving mail servers on what to do if authentication fails (monitor, quarantine, or reject) and requests daily forensic and aggregate XML reports (RUF and RUA).

When you configure a custom email domain inside HubSpot, you are essentially telling HubSpot to take over the cryptographic signing of your emails. If your SPF and DKIM are properly aligned, your DMARC policy will pass successfully, boosting your sender reputation.

Prerequisites Before Configuring DMARC for HubSpot

Do not rush to publish a strict DMARC policy without completing the foundational setup steps. Here is what you need in place first:

1. Active Custom Domain in HubSpot: You must have already connected your email sending domain inside your HubSpot account settings under Settings > Website > Domains & URLs > Brand Domains. HubSpot will provide you with specific CNAME records for SPF (often labeled as email or forward-facing routing) and DKIM (two selector keys, such as hs1._domainkey and hs2._domainkey).
2. DNS Hosting Access: You need administrative access to the DNS management panel for your domain registrar or cloud DNS provider (e.g., Cloudflare, GoDaddy, AWS Route 53, or Namecheap).
3. Access to an Aggregated Report Inboxes: Set up a dedicated email address or third-party monitoring service to receive DMARC XML reports (e.g., dmarc-reports@example.com).

Example DNS Records Provided by HubSpot

When you set up your domain in HubSpot, your DNS records typically look like this before adding DMARC:

Record Type	Host / Name	Value / Target
CNAME	hs1._domainkey.example.com	hs1.example.com.domainkeys.hubspotemail.net
CNAME	hs2._domainkey.example.com	hs2.example.com.domainkeys.hubspotemail.net
CNAME	email.example.com	forward.hubspotemail.net

Step-by-Step Hubspot DMARC Record Setup

Once your HubSpot CNAME records are verified and active, you are ready to publish your DMARC policy. Follow these steps carefully.

Step 1: Design Your DMARC Policy

A DMARC record is simply a standard TXT record published at the subdomain _dmarc.yourdomain.com. It consists of tags separated by semicolons. A safe starting policy uses p=none (monitoring mode), which allows you to review reports without blocking legitimate mail if something is misconfigured.

Example starting policy string:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100

Step 2: Access Your DNS Management Console

Log into your DNS provider's dashboard. Note that menu paths vary across providers. For instance, in Cloudflare, you navigate to Website > DNS > Records. In GoDaddy, you go to My Products > Domain > DNS > Management.

Step 3: Create the DMARC TXT Record

Create a new record using the following parameters:

• Type: TXT
• Name / Host: _dmarc (or _dmarc.example.com, depending on whether your provider automatically appends your root domain)
• Value / Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;
• TTL (Time to Live): Set to 3600 seconds (1 hour) or automatic.

Save the record and wait for DNS propagation.

Step 4: Verify Your DMARC Record

Use command-line tools or online lookup utilities to confirm your record is globally visible. Open your terminal or PowerShell and run the following command:

nslookup -type=TXT _dmarc.example.com

Or using dig:

dig TXT _dmarc.example.com +short

Sample Successful Output:

"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;"

Moving from Monitoring to Strict Enforcement

Leaving your DMARC policy at p=none indefinitely leaves your domain vulnerable to spoofing because it only monitors traffic. Once you have reviewed your DMARC XML reports for at least two to four weeks and verified that all legitimate sending sources (including HubSpot, transactional email providers, and corporate mailboxes) are passing authentication, you should ratchet up your enforcement policy.

DMARC Policy Progression

1. Monitoring (p=none): Collects data; takes no action on failing emails.
2. Quarantine (p=quarantine): Tells receiving mail servers to send failing emails directly to the recipient's spam or junk folder.
3. Reject (p=reject): Instructs receiving mail servers to outright block and drop messages that fail DMARC alignment.

To update your record for quarantine, edit your existing TXT record value to:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; sp=quarantine

To move to full rejection mode once you are 100% confident:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; sp=reject

Common Mistakes and How to Fix Them

Even experienced engineers occasionally make configuration errors when deploying email authentication. Watch out for these common pitfalls:

• Publishing Multiple DMARC Records: A domain can only have one active DMARC record. If you publish more than one TXT record at _dmarc.example.com, mail servers will ignore them entirely, invalidating your protection.
• Typoes in Tag Names: DMARC tags are strictly parsed. Writing policy=none instead of p=none or v=DMARC instead of v=DMARC1 will cause the record to fail validation.
• Lack of SPF/DKIM Alignment: DMARC requires identifier alignment. This means the domain in the visible From header must match the domain authenticated by SPF (Return-Path) or DKIM (d= tag). If HubSpot is sending from news.example.com but your From header says marketing@example.com without proper subdomain alignment, DMARC will fail.
• Missing Mailto Prefix in RUA: Always include mailto: before the email address in the rua and ruf tags (e.g., rua=mailto:reports@example.com). Omitting mailto: breaks the reporting mechanism.

Deployment Checklist

Review this quick checklist before wrapping up your hubspot dmarc record setup:

• HubSpot CNAME records (SPF and DKIM selectors) are fully verified inside HubSpot settings.
• A single TXT record exists at _dmarc.yourdomain.com.
• The protocol version tag v=DMARC1 is present and capitalized correctly.
• The policy tag (p=none, p=quarantine, or p=reject) is properly defined.
• An aggregate reporting address (rua=mailto:...) is included to monitor delivery health.
• DNS propagation has been verified using nslookup or dig.