SPF(supported) (dedicated subdomain)
DKIM(recommended)
This article covers the SPF and DKIM authentication processes for Hubspot and how are they managed in Valimail Enforce. While only one of the two authentication methods is required for an email to pass DMARC, our recommendation is to configure both whenever possible.
Hubspot supports both SPF and DKIM, but they do not send emails in SPF alignment by default.
DKIM and SPF configuration for Hubspot is done through a dedicated subdomain.
TABLE OF CONTENTS
- Configuring DKIM authentication for your Hubspot emails
- Add a Hubspot DKIM key in Enforce
- Configuring SPF authentication for your Hubspot emails
Configuring DKIM authentication for your Hubspot emails
1. In your HubSpot account, click the settings icon in the main navigation bar.
2. In the left sidebar menu, navigate to Website -> Domains & URLs.
3. Click Connect a domain.
4. In the dialog box, select Email Sending, then click Connect. You'll then be directed to the domain connection screen.
5. On the domain connection screen, enter the email address you use to send emails from this domain, then click Next.
6. On the next screen, verify that the email sending domain is correct, then click Next.
7. Copy the DKIM key records and add them in Valimail Enforce. Additionally, copy and publish the first CNAME record in your DNS directly - this will allow HubSpot to publish an SPF record for the selected subdomain.
8. When you're done updating the values in Enforce and your DNS provider, select the Done checkbox in HubSpot.
9. After you add the DKIM keys in Valimail Enforce and the other CNAME record in your DNS, you'll see a Verified message letting you know your email sending domain is verified. Once you see the Verified message, click Done.
10. If you are in the process of adding the CNAME records in Enforce and/or in your DNS, you'll might see a Record invalid error displayed to the right of one or all of your records. Click check them again to see if the changes have propagated.
You can find the instructions on how to setup DKIM in Hubspot here.
Add a Hubspot DKIM key in Enforce
1. Go to your domain's Configuration page in Valimail Enforce and publish the newly created Hubspot DKIM keys.
a. Scroll down and add the two DKIM keys in your configuration, by clicking on Add a DKIM key.
b. Enter the selector name, CNAME target value, associate the keys with HubSpot and then click Add.
You can find more detailed information on how to add a DKIM key in Valimail Enforce here.
Configuring SPF authentication for your Hubspot emails
As previously mentioned, Hubspot does not send SPF-aligned emails by default.
While it is not necessary to add HubSpot to the Enabled Senders list in Enforce, we recommend that you do so. This is done for tracking because Hubspot uses a dedicated subdomain which will be delegated to HubSpot servers. HubSpot will then publish an SPF record on that subdomain.
To configure SPF alignment, you will have to purchase the dedicated IP address add-on or the transactional email add-on from HubSpot and work with them to configure a custom bounce subdomain. You can read more on that here.
Once you establish that Hubspot is an authorized sender for your domain, you will need to add the service in your Enabled Senders list in Enforce.
1. Please go to your domain's Configuration page in Enforce.
2. Click on the + sign from the Enabled Senders section:
3. Choose Hubspot from the list of configurable senders and then click Enable:
If the Hub ID you were provided with is 123456.spf00.hubspotemail.net, fill in the HubSpot ID and SPF ID fields like below:
We encourage you to use the comment section for any useful information about your sending service, such as the name of the service owner, change request ticket numbers, etc.
As always, if you have any questions, please don't hesitate to submit a ticket.