InboxAudit

HubSpot email authentication

CRM with bundled marketing email, widely used by B2B teams.

HubSpot normally authenticates via per-portal CNAME records rather than a shared include.

SPF record

Add HubSpot to your domain's SPF record with this include:

include:_spf.hubspot.com

A complete record for a domain sending only through HubSpot:

v=spf1 include:_spf.hubspot.com ~all

What it costs you

3 of your 10 DNS lookups. The include: itself costs one, and HubSpot's record chains to 2 more. Behind it are 24 IP ranges.

Live record

This is what _spf.hubspot.com published when this page was generated:

v=spf1 ip4:54.174.63.0/24 ip4:54.174.52.0/24 ip4:52.40.63.40 ip4:52.40.63.41 ip4:52.40.63.42 ip4:52.88.240.251 ip4:52.40.63.27 ip4:52.40.63.5 ip4:52.40.63.29 include:sendgrid.net -all

DKIM

Enable DKIM inside HubSpot and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.

DMARC

Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them to it. Once HubSpot is authenticating, publish a DMARC record — start at p=none with a reporting address and tighten from there.

Generate a DMARC record →

Check it worked

DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.

Official documentation

HubSpot setup docs →