D
DKIM Test

How to Set Up DKIM for HubSpot

Step-by-step guide to configure DKIM for HubSpot email. Learn how to connect your email sending domain and authenticate your marketing emails.

Last updated: 2026-01-28

HubSpot's email tools are powerful, but without proper DKIM configuration, your marketing emails and sales sequences may land in spam. Setting up your email sending domain with DKIM helps ensure reliable delivery.

Why Set Up DKIM in HubSpot

Without domain authentication:

  • Emails show "via hubspot.com"
  • Deliverability may suffer
  • You can't fully control your sender reputation

With DKIM:

  • Emails appear to come directly from your domain
  • Better inbox placement
  • Improved sender reputation
  • Full control over your email authentication

Before You Start

You'll need:

  • HubSpot Marketing Hub or Sales Hub (Professional or Enterprise for some features)
  • Access to your domain's DNS settings
  • Admin access to HubSpot

HubSpot uses CNAME records for DKIM, allowing them to manage key rotation automatically.

Step-by-Step Setup

1

Access domain settings

In HubSpot, go to Settings (gear icon) → Website → Domains & URLs → Email Sending Domains.

Or navigate directly to the Connect a Domain wizard.

2

Connect an email sending domain

Click Connect a domain and select Email sending.

Enter the domain you want to send from (e.g., example.com).

3

View DNS records

HubSpot displays the DNS records you need to add:

DKIM Records (CNAME):

  • hs1._domainkey.yourdomain.com → HubSpot's DKIM server
  • hs2._domainkey.yourdomain.com → HubSpot's DKIM server (backup)

The exact values include your HubSpot portal ID.

4

Add records to DNS

Log into your DNS provider and add the CNAME records:

  • Type: CNAME
  • Host: hs1._domainkey
  • Value: The target HubSpot provided
5

Verify in HubSpot

Return to HubSpot and click Verify or wait for automatic verification.

HubSpot periodically checks for the records.

Verify Your Setup

After verification, test the DKIM records publicly.

Test: hs1._domainkey.yourdomain.com

HubSpot DKIM Selectors

HubSpot uses two selectors for redundancy and key rotation:

  • hs1 (primary)
  • hs2 (backup)

Add both records to ensure uninterrupted email sending.

Common Issues and Solutions

"Pending" verification

Cause: DNS hasn't propagated or records are misconfigured.

Solutions:

  • Wait 15-30 minutes (up to 48 hours in rare cases)
  • Verify both CNAME records exist
  • Check that the host field doesn't duplicate your domain

"Unable to verify" error

Cause: DNS records not found or incorrect.

Solutions:

  • Double-check the CNAME values match exactly what HubSpot provided
  • Ensure you created CNAME records, not TXT records
  • Clear any cached DNS and retry

Emails still fail authentication

Cause: SPF or DMARC issues, or wrong From address.

Solutions:

  • Ensure your From address uses the authenticated domain
  • Configure SPF for HubSpot
  • Check DMARC alignment

From address matters

Your email "From" address must use the authenticated domain. If you authenticated example.com, send from name@example.com, not name@subdomain.example.com (unless that's also authenticated).

HubSpot Free vs Paid

DKIM domain authentication is available on all HubSpot plans, but with limitations:

Free/Starter:

  • Basic domain authentication
  • HubSpot branding may appear

Professional/Enterprise:

  • Full domain authentication
  • Custom email sending domains
  • Advanced deliverability features

Complete Your Email Authentication

HubSpot handles DKIM with the domain connection process. Also configure:

SPF: Add HubSpot to your SPF record:

include:hubspotemail.net

Check at spfrecordcheck.com.

DMARC: Set up a DMARC policy. Check at dmarcrecordchecker.com.

Related Articles

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.

Never miss a DKIM issue

Monitor your SPF, DKIM, DMARC and MX records daily. Get alerts when something breaks.

Start Monitoring