DKIM for HubSpot: Email Authentication Setup Guide

This guide is part of our Marketing and CRM series.

If your HubSpot marketing emails are landing in spam folders or getting flagged by recipients' mail servers, the most common cause is missing email authentication. DKIM (DomainKeys Identified Mail) proves that your emails actually come from your domain and haven't been tampered with in transit. Without it, inbox providers like Gmail, Outlook, and Yahoo have no way to verify your messages are legitimate. HubSpot includes a built-in domain authentication feature that handles DKIM setup, but you still need to add the correct DNS records on your end. This guide walks you through every step.

How HubSpot DKIM Works

HubSpot uses CNAME-based DKIM, similar to services like SendGrid and Salesforce. Instead of giving you a raw public key to paste into a TXT record, HubSpot provides CNAME records that point to HubSpot-managed keys. Here's what that means in practice:

1. You start the domain authentication process in HubSpot settings
2. HubSpot generates a DKIM key pair and gives you two CNAME records
3. You add those CNAME records to your domain's DNS
4. HubSpot verifies the records automatically once they propagate
5. HubSpot signs all outgoing emails from that domain with DKIM

This approach lets HubSpot manage key rotation behind the scenes. Once your CNAME records are in place, HubSpot can update the underlying keys without requiring you to touch your DNS again.

Setting Up DKIM in HubSpot

HubSpot DNS Records

When you authenticate a domain, HubSpot provides two CNAME records for DKIM. The records follow this pattern:

HubSpot also provides a third CNAME record for the return-path, which aligns SPF with your domain. While this guide focuses on DKIM, you should add all three records to complete domain authentication.

HubSpot DKIM Selectors

HubSpot generates its own DKIM selectors automatically - you don't get to choose them. The selectors are tied to your HubSpot account and typically follow a HubSpot-specific naming pattern. Unlike services that let you pick a selector name, HubSpot assigns them during domain authentication.

Why two selectors? Like SendGrid, HubSpot uses dual DKIM selectors for redundancy and seamless key rotation. If HubSpot needs to rotate a key, the second selector ensures email authentication continues uninterrupted. Both CNAME records are required - don't skip one thinking it's a backup.

This also means your domain will have two _domainkey CNAME entries dedicated to HubSpot. These won't interfere with DKIM records from other email services, since each service uses its own unique selectors.

Using HubSpot with Other Email Services

Most businesses don't send all their email through HubSpot. You might use Google Workspace or Microsoft 365 for day-to-day communication, a transactional service like SendGrid for order confirmations, and HubSpot for marketing campaigns. Each of these services can have its own DKIM configuration on the same domain without conflict.

DKIM selectors are what make this work. Each service uses a different selector, so receiving mail servers know which public key to check for each email:

Simply add all the required DNS records from each service. They coexist without issues because they use different selector names. If you're managing DKIM across multiple services, consider keeping a spreadsheet of your active selectors and which service each one belongs to.

Troubleshooting HubSpot DKIM

HubSpot says verification failed

• Confirm all three CNAME records are present in your DNS (two DKIM + one return-path)
• Check that the hostnames don't include your root domain twice - some DNS providers auto-append the domain, so entering hs1._domainkey.example.com becomes hs1._domainkey.example.com.example.com
• Wait at least an hour before retrying, as DNS propagation can be slow depending on your provider's TTL settings

DKIM was working but stopped passing

• Check your DNS records haven't been accidentally removed or modified
• If you recently migrated DNS providers, make sure the CNAME records were recreated at the new provider
• Verify the records still resolve using a DNS lookup tool

Emails still landing in spam after DKIM is set up

• DKIM alone doesn't guarantee inbox placement - you also need proper SPF alignment and a DMARC policy
• Check your HubSpot email health score for content or engagement issues
• Make sure your From address domain matches the authenticated domain exactly
• Review your sending reputation - new domains or domains with no sending history may need time to build trust

Custom DKIM keys with HubSpot

• HubSpot's standard domain authentication handles DKIM automatically, so custom keys aren't typically needed
• If you have compliance requirements that demand control over your own key material, you can generate keys with DKIM Creator and work with HubSpot support for advanced configuration
• For most small and mid-size businesses, HubSpot's managed DKIM is the simpler and recommended approach

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• HubSpot official documentation — Email domain authentication and DKIM setup

---

Sending email through HubSpot and other services? Make sure every channel is authenticated with DKIM.