# DKIM record for HubSpot

URL: https://iblockspam.com/dkim/hubspot
Last updated: 2026-10-09

Record type: CNAME
Selectors: hs1-<number>, hs2-<number>
Key managed by: Provider (CNAME delegation)

HubSpot connects an email sending domain with two DKIM CNAME records, `hs1-<number>._domainkey` and `hs2-<number>._domainkey`, pointing to names under `dkim.hubspotemail.net`. HubSpot hosts the keys. Until DKIM is set up, HubSpot won't send with your domain in the From address at all.

## DNS records

- DKIM selector 1 (CNAME, host hs1-123456._domainkey): `example-com.hs[#]a.dkim.hubspotemail.net.` HubSpot's article shows `[#]` as a placeholder for a number in your account; copy the full value.
- DKIM selector 2 (CNAME, host hs2-123456._domainkey): `example-com.hs[#]b.dkim.hubspotemail.net.`

## Set it up and turn on signing

- In HubSpot, click the settings icon and go to **Content > Domains & URLs**, then the **Email Sending** tab, and click **Connect sending domain**.
- Enter a From address at the domain and click **Next** twice. Choose **Sign in with [provider]** to add the records automatically, or **No, I'll set it up manually**.
- Copy each record's **Host** and **Required data** into your DNS host. HubSpot's list also includes SPF and DMARC records.
- Back in HubSpot, the domain moves from **Not authenticated** to **Partially authenticated** once DKIM is found, and to **Authenticated** when everything is. Use **Refresh** to recheck and **Continue setup** to fix missing records.

## DMARC alignment

HubSpot says you can't send with your domain in the From address until you connect it by setting up DKIM. Without it, HubSpot rewrites the address to something like `user=yourcompany.com@hs-domain.com`. Once connected, the signature is for your domain, so DMARC can pass on DKIM. HubSpot says you can only connect a sending domain that isn't in use for another purpose, such as hosting your website.

## Key length and rotation

The keys sit behind HubSpot's CNAME targets, so any key change happens on HubSpot's side; HubSpot doesn't publish a key length or rotation schedule. Copy both Host values from HubSpot rather than reusing names from a guide or another account.

## Common mistakes

- **Cloudflare CNAME flattening or proxying.** HubSpot asks you to turn both off for these records.
- **The root domain appended to the host.** Enter `hs1-123456._domainkey`, not the full name, at hosts that add the domain.
- **A DNS host that rejects underscores or double hyphens.** HubSpot notes some do; ask the host or move DNS.
- **Stopping at Partially authenticated.** That status means DKIM works but SPF or DMARC is still missing.

**Q: What does Partially authenticated mean in HubSpot?**
HubSpot found your DKIM records but not everything else it checks, such as SPF or DMARC. You can send with the domain; click Continue setup to see which records are still missing.

**Q: Why does HubSpot rewrite my From address?**
Because the domain isn't connected. HubSpot won't send with your domain in the From address until DKIM is set up, so it uses an address like `user=yourcompany.com@hs-domain.com` instead.

**Q: Why do HubSpot DKIM selectors contain a number?**
HubSpot's examples show a number in each selector, as in `hs1-123456._domainkey`, and HubSpot generates the values for your account. Copy the exact Host value from the domain setup screen rather than a number from a guide.

Sources:
- HubSpot Knowledge Base: Manage your email authentication: https://knowledge.hubspot.com/marketing-email/manage-email-authentication-in-hubspot
- HubSpot Knowledge Base: Troubleshoot domain connection: https://knowledge.hubspot.com/email/troubleshoot-your-email-sending-domain
- HubSpot Knowledge Base: Overview of email authentication: https://knowledge.hubspot.com/marketing-email/overview-of-email-authentication

---

Source: iBlockSpam, https://iblockspam.com/dkim/hubspot (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt