In HubSpot, connect your email sending domain (Settings → Marketing → Email → Domains) and publish the CNAME/TXT records HubSpot provides for DKIM and the branded sending domain. This aligns authentication to your domain so HubSpot email passes DMARC. A common HubSpot issue is SPF passing while DMARC fails on alignment — DKIM is what fixes that.
HubSpot gives you DNS records (DKIM CNAMEs plus a branded sending subdomain) when you connect a domain. Publish them and click verify.
If you only authorize HubSpot in SPF but don’t complete domain connection, HubSpot signs with its own domain and DMARC fails on alignment. Completing the connected domain (DKIM aligned to you) resolves it.
Check the selector CNAME resolves:
$ dig CNAME hs1._domainkey.yourdomain.com +shortCheck your SPF record now
Open the free SPF checker →Because SPF authorized HubSpot’s domain, not yours (no alignment). Complete HubSpot’s connected/sending domain so DKIM is signed with your domain.
