HubSpot DKIM CNAME Connect

Why Your HubSpot Sending Domain Isn’t Verified

You’ve set up your HubSpot sending domain, but it’s stuck on “Not Verified.” You’re sending emails, but they’re landing in spam or vanishing into thin air. The real culprit? A missing or misconfigured DNS record—often something simple like a DKIM CNAME.

Think of your sending domain like a house key. If the lock (HubSpot) doesn’t recognize the key (your DNS records), you can’t get in. A single wrong CNAME can block verification, hurt deliverability, and damage your sender reputation—no matter how clean your content is.

When you’re trying to send emails from your custom domain in HubSpot, the system checks for SPF, DKIM, and MX records. Without them, your emails fail authentication. This isn’t a setup mistake—it’s a verification fail. The solution? Make sure every record is present, correct, and properly connected.

Key takeaways

DKIM, SPF, and MX records must all be correctly configured in DNS for HubSpot domain verification to succeed.
A single missing or misaligned CNAME record—especially for DKIM—can prevent domain verification and lead to email delivery failure.
Even if your domain is technically valid, incorrect authentication records harm sender reputation and inbox placement.

What Is HubSpot’s DKIM CNAME Record and Why It Matters

You can think of HubSpot’s DKIM CNAME record as a digital passport for your sending domain. It tells receiving mail servers, “These emails from your domain are actually sent by HubSpot, and they’re authentic.” Without it, emails sent through HubSpot may fail authentication checks, land in spam folders, or bounce outright. This record is a DNS-level proof of identity, required for reliable deliverability.

How DKIM Works with HubSpot

When you send an email via HubSpot, it uses DKIM to add a cryptographic signature to the message header. This signature is generated using a private key stored only by HubSpot. The public key, which validates that signature, is published in your domain’s DNS as a CNAME record. Receiving servers check this record to verify the email wasn’t forged.

If the CNAME record isn’t set up—or is wrong—receiving mail servers can’t confirm the signature’s legitimacy. As a result, your emails might be marked as spam or rejected. This isn’t hypothetical: according to RFC 6376, DKIM validation failures are a common reason for email rejection at the SMTP level.

Why Getting It Right Matters

Even if your email content is perfect, a missing or misconfigured DKIM CNAME can break sender reputation. ISPs like Gmail and Outlook use strict policies to filter out unauthenticated mail. The absence of a valid DKIM record often leads to poor inbox placement or being flagged as suspicious.

Let’s say you’ve invested in a clean email list, personalized campaigns, and strong subject lines—only to have them blocked because of an unresolved DKIM setup. That’s a waste. The fix is simple: add the CNAME record HubSpot provides to your DNS. But confirming it works? That’s another story.

You don’t need to guess. Use an inbox placement test to verify not just DKIM, but the full deliverability stack—SPF, DMARC, and spam triggers. MailTester’s inbox tester runs checks across multiple providers and reports back with exact results, so you know if your setup is working in real-world conditions. Test your domain’s deliverability today.

After setup, you can also use the bulk email verification tool to clean your list and catch any invalid addresses before sending. That way, you’re not just authenticating—your emails are also more likely to land in real inboxes.

DKIM is not optional for bulk sending. It’s a baseline requirement. HubSpot helps you set it up—but you must ensure the CNAME record is published correctly and remains stable. A single typo can break the chain of trust.

Step-by-Step: How to Connect HubSpot DKIM CNAME Records

You’ll need to add a CNAME record in your domain’s DNS settings to authenticate your HubSpot email sends. This ensures your emails are not flagged as spam and improves deliverability. The record links your domain to HubSpot’s mail servers using DKIM, a standard email authentication method. After setting it, HubSpot can verify the domain’s legitimacy in real time. Let’s walk through the setup.

Prepare your DNS console

Log in to your domain registrar’s control panel—like GoDaddy, Cloudflare, or Namecheap. Navigate to the DNS management section, usually called “Zone File” or “DNS Records.” This is where you’ll edit your domain’s public DNS entries.

Configure the DKIM CNAME record

Go to your domain’s DNS zone file and create a new CNAME record.
Set the Name/Host to: your-domain-key.hs1.your-hubspot-domain.com (replace with the exact value provided in HubSpot, e.g., dkim1.hs1.hubspot.com).
Set the Value/Target to the value HubSpot provides—this is a unique string assigned to your domain's DKIM key.
Set TTL to 3600 seconds (or use the default, which is common).
Save the record. DNS changes can take up to 48 hours to propagate globally, though most resolve within 24.

While you wait, ensure your email sending domain is added in HubSpot. Go to Settings > Mail > Sending Domains and select the domain you’re configuring. Click “Verify” to initiate the authentication check. HubSpot will query DNS for your CNAME record. If it matches, the domain is verified.

The 5 steps described in “Configure the DKIM CNAME record”, in order.

Why this matters for deliverability

DNS records like CNAME are foundational to email authentication. Without proper DKIM, your messages risk being rejected or sent to spam folders—common in high-volume campaigns. According to RFC 6376, DKIM signatures help recipients validate that emails were not altered in transit and originate from an authorized domain.

For teams managing large email lists, verifying SPF, DKIM, and DMARC alignment is essential. A clean domain setup reduces bounce rates and supports inbox placement. If your list has invalid or disposable addresses, even a correctly configured domain won’t help.

Use tools like MailTester’s bulk verification to clean your list before sending. It checks for invalid, role-based, and disposable email addresses with 98.9% accuracy. Real-time verification via the API helps you validate before or during send. Test inbox placement with MailTester’s inbox tester to see how your messages land in real inboxes, not just spam filters.

Once configured, your HubSpot domain’s DKIM will work silently in the background. Verification appears as “Verified” in HubSpot’s Mail settings. You’ll see improved sender reputation over time, especially when combined with clean list hygiene and consistent sending patterns.

How HubSpot Assigns HS1 and HS2 CNAME Keys

HubSpot automatically generates two CNAME records—HS1 and HS2—to secure your outbound emails via DKIM. These records provide redundancy and support key rotation without disrupting email delivery. You must publish both to ensure all campaigns and automation flows pass authentication.

Redundancy and Key Rotation

Each CNAME key is tied to a subset of your outbound emails, allowing HubSpot to rotate keys independently. This means if one key needs updating or fails, the other maintains delivery. It’s an industry-standard practice for high-volume senders to prevent mail drops during cryptographic updates.

While HubSpot manages the keys, you’re responsible for publishing both records in your domain’s DNS. Missing either one leaves part of your email stream unauthenticated, increasing the risk of inbox placement issues or rejection by strict filters.

Why Both HS1 and HS2 Are Required

Running only one CNAME record may work for a few messages, but fails under scale. Without both, you lose coverage for half your campaigns—especially those sent via different triggers or flows. This can result in inconsistent deliverability, even with proper SPF and DMARC alignment.

As the DMARC specification states, authentication failures due to missing DKIM keys lead to email rejection by many providers. The IETF’s RFC 6376 clarifies that DKIM signing should be consistent and resilient across all sending endpoints—exactly what HS1 and HS2 support.

When verifying your domain, ensure both CNAMEs are live. Tools like MailTester’s DKIM verification can help spot misconfigurations before you send. If you're testing deliverability, use MailTester’s inbox placement tester to simulate real-world inboxing.

Common Issues with HubSpot Sending Domain Not Verified

You’re likely stuck on “Sending Domain Not Verified” in HubSpot because you’ve published only one CNAME (HS1 or HS2), misspelled the host name (like 'hs1' instead of 'h1'), used a subdomain without proper DNS delegation or SPF alignment, or assumed DNS changes took effect immediately. These are the most frequent culprits — and each one halts verification.

Missing Both CNAME Records

HubSpot requires both HS1 and HS2 CNAME records to verify your domain. Publishing only one means verification fails.
Double-check that you’ve added both. One record alone is not sufficient under HubSpot’s validation process.

Typo in Host Name or Subdomain Prefix

Common mistakes include typing hs1 instead of h1 or using mail. when it should be mail. (if configured that way).
Even a single typo in the host field breaks the validation. Use exact names from your HubSpot account — copy-paste to avoid errors.

Subdomain or SPF Misalignment

Using a subdomain like newsletter.yourcompany.com? Ensure it’s properly delegated in DNS and that SPF records are aligned across senders.
Missing or conflicting SPF records can trigger email rejection even if DKIM and CNAME are correct.
Learn more about SPF alignment from the IETF’s guidelines: RFC 7208, Section 6.

Assuming Immediate DNS Propagation

DNS changes can take up to 48 hours to propagate globally. Many users retry verification prematurely.
Check propagation status using tools like MxToolbox DNS Check or DNSChecker.org.
Even with correct records, verification won’t succeed until full propagation is complete.

These issues are fixable — and preventable with careful setup. Use a tool like MailTester’s bulk verification to double-check the validity of your sender domains and email addresses before deployment. It’s a proven way to reduce bounces, avoid blocklists, and maintain sender reputation.

Verify DKIM and SPF Alignment in HubSpot

You’ve added the CNAME records for DKIM and SPF in your DNS provider—now return to HubSpot, wait a few minutes, and check that your domain status changes to 'Verified'. Confirm SPF includes include:spf.hubspot.com and that no conflicting SPF records exist. Use tools like MXToolbox to verify the DNS entries resolve correctly, and ensure your SPF string stays under 10 entries to avoid failures.

Check SPF Alignment and Avoid Common Pitfalls

Go to HubSpot’s Marketing > Email settings > Domains, and confirm your domain shows as "Verified" after DNS propagation (usually 5–10 minutes).
Verify your SPF record includes include:spf.hubspot.com—this authorizes HubSpot’s mail servers to send on your behalf.
Check for duplicate SPF records. Having multiple SPF records in DNS causes validation failure—even if one is correct.
Ensure your SPF record length stays under 10 includes. Excessive includes or long strings may exceed the 10KB limit, breaking SPF alignment.
Use MXToolbox to test your DNS records. Enter your domain and review the SPF and CNAME entries for correctness.

Validate DKIM and Finalize Setup

After DNS propagation, check that the DKIM CNAME record resolves to the correct HubSpot value (e.g., mail1._domainkey.example.com → key1.hb-dkim.com).
Test your full configuration using an authenticated email tool like MailTester’s Inbox Placement Test to simulate real inbox delivery.
Monitor bounces and spam complaints. Misaligned DKIM or SPF can lead to delivery failures or inbox filtering—even with valid recipients.
If issues persist, use RFC 7208, Section 5 to review SPF record structure and limits.
For large lists, verify sender reputation and domain alignment using MailTester’s bulk verification to catch invalid or risky addresses early.

Proper SPF and DKIM alignment isn’t optional. It’s the foundation of deliverability. A single misconfigured record can tank your sender reputation with ISPs.

Use MailTester to Test Inbox Placement After Verification

Even after successfully connecting your HubSpot email sending domain via CNAME, inbox placement isn’t guaranteed. A proper DKIM setup is necessary but not sufficient. You need to verify that your emails actually land in inboxes—without being filtered as spam—across real user environments. MailTester’s inbox-placement testing simulates delivery to Gmail, Outlook, Apple Mail, and other major providers using hundreds of real email accounts, checking spam filters, routing rules, and delivery behavior.

Verify Delivery Before You Send

Let’s be clear: a domain can pass technical checks like SPF, DKIM, and DMARC, yet still end up in spam folders. Your verified domain might be technically “correct,” but that doesn’t mean it’s trusted by inbox providers. MailTester tests your HubSpot domain’s deliverability by sending sample messages to 100+ real inbox environments, including those managed by Microsoft and Google. The results show you exactly where your email lands—inbox, spam, or deleted—and what score it received from spam filters.

After testing, you’ll see your inbox placement percentage, an individual spam score for each provider, and a detailed header analysis. This reveals any issues in your message headers, authentication chains, or content that might trigger spam filters. For example, if your email lacks a valid return-path or includes suspicious content patterns, MailTester flags them with transparent, actionable insight. This level of detail is critical because even a small header flaw—like a missing DKIM signature or inconsistent From domain—can impact deliverability.

Test your verified HubSpot domain with Inbox Placement to catch issues before your campaign goes live. Use it on a small list first, then scale up. You can also integrate MailTester with your marketing stack via our HubSpot integration for automated testing in your workflow. For large lists, use the bulk verification tool to clean and prep your data, then validate delivery with inbox placement. Every test is backed by our 98.9% accuracy rate—no guesswork, just data.

Industry practices like those described in the DKIM standard (RFC 6376) confirm that correct signature alignment is just the first step. Real inbox placement depends on reputation, content, and sender history. MailTester doesn’t just tell you if mail goes through—it shows you why it does, or doesn’t.

How MailTester's Real-Time API Helps With List Hygiene

Run every email through MailTester’s real-time API before sending—catch invalid addresses, disposable domains, and catch-all emails before they hurt your deliverability. This cuts bounce rates by up to 90%, especially critical when sending large campaigns through HubSpot. It also flags role-based addresses like info@ or sales@ that degrade sender reputation, helping you maintain a clean, high-performing list.

Why Real-Time Checks Prevent Send Failures

You’re not just cleaning your list—you’re protecting your sender reputation. Every hard bounce damages your trust score with inbox providers. MailTester’s API uses live SMTP checks to verify addresses in real time, detecting traps like catch-all domains or expired disposable emails that bulk tools miss. The result? Fewer delivery failures and a smoother path to the inbox. This is especially vital when syncing with HubSpot, where even a small bounce rate spikes can trigger spam filters.

Automate Verification in Your Workflows

Let’s say you send weekly newsletters via HubSpot. Instead of manually scrubbing your list, integrate MailTester’s API directly into your workflow or connect it through SendGrid, which supports API-based verification. The system checks every address before deliverability engines like HubSpot handle the send. You can test your list in bulk using our email list verification tool or automate it with a single API call. This turns list hygiene from an afterthought into a consistent, reliable layer of your email stack.

MailTester’s 98.9% accuracy comes from a blend of DNS, SMTP, and heuristic analysis—all verified against industry standards like RFC 5321 and RFC 6409, which define how mail servers respond to invalid or malformed addresses. While no tool catches every edge case, MailTester’s approach reduces false positives and flags risky patterns early—like addresses with suspicious formats or those commonly used by bots. You can see how it works in real time with our inbox placement tester, or start testing with 100 free verifications at no risk.

HubSpot vs. Other Email Tools: What to Know About CNAME Setup

You don’t get around setting up CNAME records for DKIM in HubSpot, Mailchimp, SendGrid, or Klaviyo—each requires manual DNS changes to authenticate outbound emails. While the core goal is the same, the format and host targets differ per platform. You can’t skip this step, but tools like MailTester help you confirm it’s done right and whether your emails will actually land in inboxes.

Different Tools, Different CNAME Syntax

HubSpot uses a specific CNAME format tied to its domain infrastructure, like hs-dkim._domainkey.yourcompany.com pointing to a unique string from HubSpot’s dashboard. Mailchimp and SendGrid follow similar patterns, but their DNS hosts and target values are different. Klaviyo, while also requiring CNAME setup, uses different naming conventions and may require separate records for different subdomains. The exact structure isn’t interchangeable across platforms—misalignment here causes authentication failures.

It’s common to mix up the host and target values, especially when managing multiple tools. Always double-check your DNS editor against the official documentation from the provider. You can find baseline guidance in RFC 6376 and RFC 6377, which define DKIM’s technical specifications. These RFCs are the gold standard for how public-key authentication works across email systems.

Verification Tools: What They Actually Do

Tools like NeverBounce and ZeroBounce focus on validating email lists before sending—checking if addresses exist, are disposable, or are role-based. They don’t handle DNS configuration or DKIM setup. You still need to set up CNAME records manually with your domain provider, even after a list passes verification.

Similarly, Bouncer and Kickbox specialize in real-time address validation, offering high accuracy for individual emails. But they don’t assess deliverability or test whether your DNS setup will let your emails reach inboxes. That’s where MailTester stands out. It combines real-time verification with inbox placement testing. You can check if an email is valid, then test whether it lands in Gmail, Outlook, or Apple Mail—without sending a single message to a real user.

For teams managing campaigns across HubSpot, Mailchimp, or SendGrid, this dual ability is essential. You can use the bulk verification tool to clean up your list, the API for real-time checks in your app, and the inbox placement tester to validate delivery before launch. No tool auto-configures DNS—DNS changes are always manual—but MailTester helps you verify that your setup will actually work.

And unlike other tools, MailTester’s accuracy is built on continuous testing across real inboxes, not just pattern matching or blacklist checks. It doesn’t replace DNS setup, but it tells you whether it’s working.

Why You Should Never Skip DKIM Verification on HubSpot

Skipping DKIM verification on HubSpot means your emails are treated as untrusted—no matter how well-written they are. Without proper authentication, even clean campaigns land in spam folders, and your sender reputation suffers silently. Repeated failures can take months to repair, damaging long-term outreach. Use tools like MailTester to test deliverability early and catch risks before they scale.

What Happens When DKIM Isn’t Set Up

HubSpot sends from a domain without DKIM are flagged by modern spam filters, even if content is perfect.
Emails from unverified domains often get auto-tagged as "suspicious" by ISPs like Gmail and Outlook.
Sender reputation isn’t just about volume—it’s about trust. Each unauthenticated send erodes it slightly.
Reputation damage from poor authentication can take 60–90 days to reverse, even after corrections.
Spam scoring systems evaluate the full email chain—unverified domains are a red flag at every layer.

How to Prevent This Before It Starts

Let’s be clear: you can’t rely on HubSpot’s default settings alone. Even if your emails look clean and your content is relevant, a missing DKIM record means they’ll never be trusted by major providers.

Always verify your sending domain in HubSpot’s settings, then confirm the DKIM record is published correctly.
Use a real-time verification tool like MailTester’s API to test individual domains before launch.
Run inbox placement tests on your campaign templates using MailTester Inbox Placement to see if your authenticated emails land in inboxes.
Check your DNS records with a trusted third-party like MXToolbox to validate DKIM and SPF setup.
Run bulk list verification on your entire contact database via MailTester’s bulk tool to catch invalid or risky addresses early.

Even one unverified sending domain can undermine every other deliverability effort you’ve made.

DKIM isn’t a checkbox. It’s the foundation of trust. Without it, you’re not just sending emails—you’re sending signals that you’re untrustworthy.

And that’s why MailTester exists: to catch these issues before they hurt your outreach. Whether you're using HubSpot, SendGrid, or another platform, your deliverability depends on the basics. Verify them. Test them. Fix them.

Conclusion: Complete the Verification Chain for Reliable HubSpot Sends

Connecting HubSpot’s DKIM CNAME records is not optional—it’s required for inbox delivery. Without proper alignment between your domain, SPF, and DKIM, emails risk rejection, filtering, or being marked as spam.

Ensure both the HS1 and HS2 DKIM records are published correctly in your DNS, allow time for propagation, and verify alignment using tools that test real inbox placement. Misconfigurations here disrupt authentication and degrade sender reputation over time.

Verification is continuous. Even after setup, maintain clean lists with regular validation and monitor deliverability to sustain high inbox placement. Use MailTester’s API and inbox checks to confirm your configuration works in practice, not just on paper.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
The number of top domains at DMARC enforcement grew from 233,249 in 2023 to 411,935 in 2026 — a 77% increase driven largely by mailbox-provider sender mandates. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How long does it take for HubSpot DKIM CNAME to verify?

After publishing the CNAME records, it may take up to 48 hours for DNS propagation. HubSpot checks periodically during that window.

What happens if I only publish HS1 and not HS2?

Your domain may appear verified temporarily, but full DKIM coverage fails. Some emails may be rejected or marked as unauthenticated.

Can I use a subdomain as my HubSpot sending domain?

Yes, but you must publish the DKIM CNAME records at the subdomain level and ensure SPF includes HubSpot's servers.

How do I check if my DKIM CNAME record is correct?

Use a DNS lookup tool like MXToolbox or dig in terminal. Search for the full host name and confirm the value matches HubSpot’s provided target.

Does MailTester replace HubSpot’s domain verification?

No. MailTester tests inbox placement and list quality after verification. It does not configure DNS records.

Is there a free way to test my HubSpot email deliverability?

Yes—MailTester offers 100 free verifications to start. Use them to test inbox placement and validate email addresses before sending.

Why do some HubSpot emails still go to spam after DKIM setup?

SPF alignment, content quality, sender reputation, and volume spikes can still trigger spam filters. Use MailTester’s inbox testing to diagnose.

Can I reuse the same DKIM CNAME for multiple HubSpot accounts?

No. Each HubSpot account generates unique DKIM keys, requiring separate CNAME records per account or domain.

How does MailTester help reduce bounces in HubSpot campaigns?

By identifying invalid, catch-all, and disposable emails before sending. Its 98.9% accuracy prevents wasted sends and maintains sender reputation.

What is the difference between SPF and DKIM in HubSpot?

SPF authorizes specific servers to send mail for your domain. DKIM cryptographically signs each email to verify authenticity. Both are required for full deliverability.