In HubSpot, go to Settings > Content > Domains & URLs > Email Sending Domains. Click Connect Domain, enter your domain, and HubSpot provides two CNAME records for DKIM. Add both to your DNS provider. HubSpot verifies the records and begins signing all outbound email with your domain's DKIM key.
DKIM for HubSpot: Setup Guide
Connect Your Email Sending Domain
- In HubSpot, go to Settings > Content > Domains & URLs
- Click the Email Sending Domains tab
- Click Connect Domain
- Enter the domain you use in your From address
- HubSpot generates two CNAME records
Add the CNAME Records
HubSpot provides two DKIM records:
| Record Type | Host | Value |
|---|---|---|
| CNAME | hs1._domainkey.yourdomain.com | yourdomain-com.hs01a.dkim.hubspotemail.net |
| CNAME | hs2._domainkey.yourdomain.com | yourdomain-com.hs01b.dkim.hubspotemail.net |
The exact values are unique to your account — copy them from HubSpot's dashboard.
Practitioner note: HubSpot's two-selector approach is the same pattern Microsoft uses. The second selector is a standby for key rotation. When HubSpot rotates keys, they switch to the second selector smoothly.
Verify in HubSpot
HubSpot automatically checks your DNS records after you add them. You can also manually trigger verification from the Email Sending Domains page.
Once verified, HubSpot shows a green "Connected" status. All outbound email from HubSpot will now be DKIM-signed with your domain.
What Happens Without Custom DKIM
Without domain authentication, HubSpot sends email signed with their own domain. Your DMARC policy can't find alignment because:
- SPF passes for HubSpot's domain, not yours
- DKIM signs with HubSpot's domain, not yours
- DMARC checks alignment against your From domain
Result: DMARC fails. If you're at p=quarantine or p=reject, your HubSpot emails go to spam or get rejected.
Practitioner note: This is one of the most common issues I see when businesses advance their DMARC policy. They forget HubSpot is sending on their behalf, move to p=quarantine, and suddenly marketing emails vanish. Always check your DMARC reports before advancing.
Confirm DKIM Is Working
Send a test email from HubSpot and check the headers:
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.s=hs1
If [email protected], your custom DKIM is active. If it shows a HubSpot domain instead, authentication isn't connected properly.
If you're running HubSpot alongside other marketing and transactional senders and need unified authentication, reach out for help.
Sources
- HubSpot: Connect an email sending domain
- HubSpot: Email authentication in HubSpot
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- MXToolbox: DKIM Record Lookup
v1.0 · April 2026
Frequently Asked Questions
How do I set up DKIM in HubSpot?
Go to Settings > Content > Domains & URLs > Email Sending Domains, click Connect Domain, and HubSpot provides two CNAME records. Add them to DNS and verify.
Does HubSpot require DKIM for sending?
HubSpot strongly recommends it and will send with their default domain if you don't configure custom DKIM. This causes DMARC alignment failures for your domain.
What DKIM selectors does HubSpot use?
HubSpot uses two selectors (hs1 and hs2) via CNAME records, enabling automatic key rotation.
Can I authenticate multiple domains in HubSpot?
Yes. Each sending domain in HubSpot needs its own pair of CNAME records. You can connect multiple domains from the Email Sending Domains page.
How long does HubSpot DKIM setup take?
The setup itself takes 5 minutes. DNS propagation typically takes 15 minutes to a few hours. HubSpot checks periodically and confirms when the records are live.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.