Manage your email authentication

You can connect your email sending domain to HubSpot to ensure your marketing emails comply with the authentication standards and sending policies enforced by major email inbox providers. 

During the connection process, you will set up three separate DNS record types: DKIM, SPF, and DMARC. Learn more about understanding these email authentication methods and updating DNS records.

Before you get started

Before you begin working with this feature, make sure to fully understand what steps should be taken ahead of time, as well as the limitations of the feature and potential consequences of using it. 

Understand requirements

• To connect your domain, you will need to update your DNS records. Ensure you have login details for your DNS provider and access to the associated DNS records.
• All accounts may connect up to 2000 email sending domains. You will need to own and have access to each domain. 
• If you're using Cloudflare to configure your email sending domain, make sure that domain-wide CNAME flattening and proxy settings are turned off.
  

Understand limitations & considerations

• You can only authenticate an email sending domain that's not currently in use for another purpose, such as hosting your website. Learn more about choosing an email sending domain.
• You can connect a subdomain, like info.domain.com, as your email sending domain. The subdomain you connect should match the domain in the From email address you're using to send marketing emails in HubSpot.
• Email sending domains can be connected to multiple HubSpot accounts simultaneously. 

Configure authentication for your email sending domain

• In your HubSpot account, click the settings settings icon in the top navigation bar.

• In the left sidebar menu, navigate to Content > Domains & URLs.

• In the top right, click Connect a domain.

• In the dialog box, select Email Sending, then click Connect. 

• On the domain connection screen, enter an email address you use to send marketing emails, then click Next.
• Verify that the email sending domain is correct, then click Next. 
• If available for your DNS provider, click Sign in with [provider], or click No, I'll set it up manually to set up the DNS records yourself. 

• After you've logged into your DNS provider, add the records required for authentication. DKIM requires two CNAME records, while SPF records and DMARC each require a TXT record. Learn more about the different email authentication methods. 
• For each authentication method, click Copy next the value in the Host and Required data columns, then paste the values in your DNS provider. 

• Add the string in the Required data column after include: to the end of the existing SPF record. 
• Verify that the SPF version and -all flag are only included once.
• Review the following example for how a TXT record should be configured with multiple SPF entries:

Check record authentication status

DNS records can take from 10 to 70 minutes to be fully verified. You can check the status of your DKIM, SPF, and DMARC authentication methods in domain settings: 

• In your HubSpot account, click the settings settings icon in the top navigation bar.

• In the left sidebar menu, navigate to Content > Domains & URLs, then scroll down to the Email sending domains section. 

• Each email sending domain will display one of the following statuses: 
  • Not authenticated: none of the three authentication methods have been fully set up or have yet to be verified.
  • Partially authenticated: DKIM has been correctly set up and verified but SPF or DMARC still need to be fully verified.
  • Authenticated: DKIM, SPF, and DMARC have all been fully set up and verified.

Please note: a subdomain will be considered authenticated if there's a DMARC record configured at the root domain level, due to DMARC policy inheritance.

If there's an issue with one of your DNS records, you can click Continue setup to review the associated DNS record value(s) that you need to add in your DNS provider.

Review recommendations for changing your email sending domain

If you are planning to change domain you use for marketing email, it's recommended to first review these best practices: 

• Use a familiar From name: when setting the sender information for your marketing emails, select a concise name that will be familiar to your recipients. 
• Connect multiple subdomains: if you have multiple email types or brands, use multiple subdomains to differentiate them. Learn more about selecting email subdomains. 
• Inform subscribers: before changing your email sending domain, send an email to your subscribers informing them of the coming change with the following information: 
  
  • A recommendation they add your new sending domain to their allowlist. 
  • A link to a landing page where you explain the reason for the change. 
• Consider accepting replies: if you're currently using a [email protected] email address to send your marketing emails, consider switching to an inbox where you can read subscriber replies to your emails and monitor their feedback. 
• Announce in phases: if you have a large number of subscribers, consider sending the change announcement email to a small number of highly engaged subscribers first, then modifying it based on their feedback. 
• Use the old and new domains together: while you're transitioning, use both domains to make sure recipients understand the change. For example, you could reference "[newdomain].com, formerly [olddomain].com."
• Optimize your email list: review recommendations for cleaning up your subscriber list. This will ensure your new domain has the best sender reputation possible. 
• Verify DKIM, SPF, and DMARC are set up correctly: make sure your new domain is fully authenticated before sending any marketing emails. If you are using a dedicated IP address, make sure it is linked with your new domain. 
• Monitor email data: once you've made the change, monitor your open, click, and unsubscribe rates, as well as negative feedback. A small decrease in engagement is expected.
• Warm up your domain: transition email volume from your old domain to your new domain slowly over time. It's also recommended to start by contacting only highly engaged contacts on the new domain.