You set up HubSpot, connected your CRM, built your first campaign, and hit send. Then someone on your team opens the email in Gmail and notices something. Right under your name, in grey text: via hubspot.com.
It looks like a mass marketing system sent it, because as far as Gmail is concerned, that is exactly what happened.
The “via hubspot.com” label is not a cosmetic issue. It tells the recipient that the email did not come directly from your domain. It means your DKIM is not aligned. And if your domain has a DMARC policy above p=none, some of those emails are already failing authentication quietly in the background, landing in spam or getting bounced before they reach anyone.
Here is what is happening and how to fix it.
Why the label appears
When you send marketing emails through HubSpot without connecting your domain, HubSpot sends the email using its own infrastructure and signs it with its own DKIM key. The d= field in the DKIM signature reads hubspot.com, not yourdomain.com.
DMARC alignment requires the domain in the DKIM signature to match the domain in the visible From address. If your email says it comes from marketing@yourcompany.com but the DKIM signature says d=hubspot.com, alignment fails. SPF has the same problem: HubSpot’s servers are sending the mail, and unless your SPF record explicitly includes HubSpot, SPF fails alignment too.
One aligned pass (either SPF or DKIM, matching your From domain) is all DMARC needs. But without connecting your domain to HubSpot, you get neither.
The “via hubspot.com” label is Gmail’s way of showing the mismatch. It appears when the authenticated domain differs from the visible sender. Fix the authentication, and the label disappears.
What you need to do
The fix is domain authentication inside HubSpot. It connects HubSpot’s sending infrastructure to your domain by publishing two CNAME records in your DNS. Once those records are in place, HubSpot signs outgoing emails with a DKIM key tied to your domain, not its own.
Step 1: Go to domain settings in HubSpot
In your HubSpot account, go to Settings (the gear icon) and then navigate to Domains & URLs. From there, select Email Sending Domains.
If you have not connected a sending domain yet, you’ll see an option to connect one. Click it.
Step 2: Enter your sending domain
HubSpot will ask for the domain you want to connect. This is the domain in your From address, for example yourcompany.com.
HubSpot recommends using a subdomain like email.yourcompany.com as your dedicated sending domain rather than the root domain. The reason is practical: if your sending reputation takes a hit (a campaign gets flagged, spam complaints spike), it stays isolated from your main domain’s reputation. It also makes authentication records cleaner to manage. Either approach works for fixing the “via hubspot.com” label, but a dedicated subdomain is the better long-term setup.
Step 3: Add the CNAME records to your DNS
HubSpot generates two CNAME records. They look something like this:
smtpapi._domainkey.email.yourcompany.com CNAME smtpapi._domainkey.hubspot.com
s1._domainkey.email.yourcompany.com CNAME s1._domainkey.hubspot.net
(The exact values come from your HubSpot account. Use what HubSpot gives you, not these examples.)
Add both records to your DNS provider. The record names go in the hostname or name field; the CNAME values go in the points-to or target field.
DNS propagation typically takes between 15 minutes and a few hours. Some providers take longer. HubSpot will verify the records automatically.
Step 4: Verify in HubSpot
Once the records have propagated, return to the Email Sending Domains page in HubSpot. The status should show as verified. If it doesn’t verify within an hour, double-check that there are no extra spaces or punctuation in the record values, and that you added both records, not just one.
After verification, HubSpot signs all emails sent from that domain using your DKIM key. The “via hubspot.com” label disappears.
SPF for HubSpot
HubSpot handles its own SPF automatically by managing the return-path (envelope sender) domain. You do not need to add include:hubspot.com to your SPF record for HubSpot marketing emails once your domain is connected via DKIM. DKIM alignment alone is sufficient for DMARC to pass.
That said, if your DMARC reports are showing SPF failures from HubSpot alongside the DKIM failures, you can add HubSpot’s SPF include to your existing record:
include:sendgrid.net
Wait, that is SendGrid’s include, not HubSpot’s. HubSpot’s correct SPF include is:
include:_spf.hubspot.com
Add it to your existing SPF TXT record at yourdomain.com. Keep your total SPF lookup chain under 10 DNS lookups or you’ll hit a PermError, which causes SPF to fail entirely. If you’re already close to the limit, focus on getting DKIM aligned first. One aligned pass is all DMARC needs.
What your DMARC record needs to look like
If you don’t have a DMARC record yet, publish one at _dmarc.yourdomain.com as a DNS TXT record. Start at p=none so you can monitor traffic without affecting delivery:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;
The rua= tag tells receivers where to send aggregate reports. Those reports are how you’ll see whether HubSpot emails are passing alignment after the CNAME records go in.
If you already have a DMARC record at p=quarantine or p=reject, connecting HubSpot’s domain authentication is more urgent. Emails failing DMARC alignment at those policies are either being moved to spam or rejected outright. The fix is the same, but every send is actively costing you deliverability until you complete it.
How to confirm it’s working
Send a test campaign after the CNAME records verify. Open the email in Gmail and click the three dots in the top right, then select “Show original”. Look for the authentication results near the top of the raw headers:
dkim=pass (yourdomain.com)
spf=pass
dmarc=pass
If dkim=pass shows your domain rather than hubspot.com, the alignment is correct. The “via” label will not appear on the sent message.
If you want to check without sending a campaign, most header analysis tools (including the free Header Analyzer in DMARCS) will read the raw headers from a test message and show you exactly which domain signed the DKIM and whether it aligns with the From address.
One thing to check if you use a subdomain as your sending domain
If your From address uses a subdomain (like news@email.yourcompany.com), your DMARC record at _dmarc.yourcompany.com covers it under relaxed alignment, which is the default. Relaxed alignment allows a subdomain of the organisational domain to satisfy alignment, so email.yourcompany.com aligns with yourcompany.com under p=relaxed.
You do not need a separate DMARC record at _dmarc.email.yourcompany.com unless you want a different policy specifically for that subdomain. For most HubSpot setups, the root domain’s DMARC record covers everything.
Once the CNAME records are verified, the “via hubspot.com” label stops appearing, your DKIM aligns, and your emails pass DMARC correctly. If you want to see all your sending sources (HubSpot, your CRM, your transactional email provider) in one place with live alignment status, the Sending Sources view in DMARCS shows exactly that. It identifies each source by name rather than raw IP, so you can see at a glance which ones are passing and which ones still need work.
