DKIM record for HubSpot

The DNS records

The examples use HubSpot's sample number 123456 and the domain example.com. HubSpot shows your Host and Required data values when you connect the domain.

DKIM selector 1

Type: CNAME · Host: hs1-123456._domainkey Copy

example-com.hs[#]a.dkim.hubspotemail.net.

HubSpot's article shows [#] as a placeholder for a number in your account; copy the full value.

DKIM selector 2

Type: CNAME · Host: hs2-123456._domainkey Copy

example-com.hs[#]b.dkim.hubspotemail.net.

Set it up and turn on signing

1. In HubSpot, click the settings icon and go to Content > Domains & URLs, then the Email Sending tab, and click Connect sending domain.
2. Enter a From address at the domain and click Next twice. Choose Sign in with [provider] to add the records automatically, or No, I'll set it up manually.
3. Copy each record's Host and Required data into your DNS host. HubSpot's list also includes SPF and DMARC records.
4. Back in HubSpot, the domain moves from Not authenticated to Partially authenticated once DKIM is found, and to Authenticated when everything is. Use Refresh to recheck and Continue setup to fix missing records.

DMARC alignment

HubSpot says you can't send with your domain in the From address until you connect it by setting up DKIM. Without it, HubSpot rewrites the address to something like user=yourcompany.com@hs-domain.com. Once connected, the signature is for your domain, so DMARC can pass on DKIM. HubSpot says you can only connect a sending domain that isn't in use for another purpose, such as hosting your website.

Key length and rotation

The keys sit behind HubSpot's CNAME targets, so any key change happens on HubSpot's side; HubSpot doesn't publish a key length or rotation schedule. Copy both Host values from HubSpot rather than reusing names from a guide or another account.

Common mistakes

• Cloudflare CNAME flattening or proxying. HubSpot asks you to turn both off for these records.
• The root domain appended to the host. Enter hs1-123456._domainkey, not the full name, at hosts that add the domain.
• A DNS host that rejects underscores or double hyphens. HubSpot notes some do; ask the host or move DNS.
• Stopping at Partially authenticated. That status means DKIM works but SPF or DMARC is still missing.