topic Re: DKIM and DMARC Setup in Email Deliverability

DKIM and DMARC Setup

Timbrowntown — Tue, 16 Apr 2024 19:30:33 GMT

We're currently in the process of setting up HubSpot for our marketing emails, and I wanted to touch base with you regarding some DNS aspects in regards to our exchange based email.

At present, our mydomain.com (example) domain lacks DMARC or DKIM authentication, although we have SPF configured. We're planning to implement DMARC and DKIM once we migrate to M365. However, HubSpot requires us to add DKIM records now.

Could you please advise if adding these DKIM records for HubSpot would impact the deliverability of our regular mydomain.com emails? From what I understand, it seems like this would only affect the hubspotemail.net records, but I wanted to double-check with you before proceeding with the changes. Or, should we look at setting up a subdomain for the hubspot emails?

Below are the specific records HubSpot has requested:

CNAME

hs1-21824228._domainkey

mydomain.hs13a.dkim.hubspotemail.net.

CNAME

hs2-21824228._domainkey
mydomain.hs13b.dkim.hubspotemail.net.

TXT

_dmarc

v=DMARC1; p=none;

Re: DKIM and DMARC Setup

evaldas — Tue, 16 Apr 2024 21:09:34 GMT

Hi @Timbrowntown

The short answer is that it is unlikely to affect deliverability of your regular/direct emails.

The DKIM record is essentially used to verify that you are the owner of the domain that is used in the "from/reply-to" email addresses when sending marketing emails with HubSpot - in order to prevent spoofing.

The DMARC record that HubSpot is requesting to add is a so called "Neutral policy", which also is supposed to help prevent spoofing and it does not explicitly do much besides allow you to receive reports about failed authentication attempts. There are advanced methods of setup that deal with stricter rules and quarantine, which is beyond the needs of HubSpot.

HubSpot has a good article explaining email authentication in more detail if you're curious: https://knowledge.hubspot.com/marketing-email/overview-of-email-authentication

The reason I said "unlikely" in the short answer is that it's still possible to create a negative effect - if someone was to start maliciously spamming inboxes via HubSpot, even with authenticated domains, then the domain might get flagged by email providers, which could affect email delivarability from other platforms or even direct sends.

Hope this helps!

Re: DKIM and DMARC Setup

Timbrowntown — Wed, 17 Apr 2024 13:22:26 GMT

Yes. This clarification helps a lot. Would the individual responsible for spamming inboxes via HubSpot, which could potentially result in our domain being flagged, need to be sending these emails from our account? I apologize for not being able to directly access the front end where the marketing emails are sent from, as I'm primarily handling the back end of these operations. My concern arises from whether they must send these emails from our account, which I assume is password-protected. If that's the case, it's manageable. However, if HubSpot itself tends to get flagged, affecting our email delivery, would it be advisable to set up our HubSpot under a subdomain?

Re: DKIM and DMARC Setup

evaldas — Wed, 17 Apr 2024 14:27:28 GMT

These are good questions.

HubSpot allows granular control on who can do what in the platform. For example, you could have 10 users in your HubSpot portal - then you could allow only 3 of those users to create emails and even take it further by allowing only 1 person to actually schedule/send those emails. Each user account is password protected (and likely has 2FA) so it's very manageable from that perspective.

In terms of HubSpot itself being flagged, while sender IP address is a factor, HubSpot does a good job in maintaining email sending reputation even while utilizing shared IP addresses. If you were to send a huge volume of emails (over 100K weekly), then a dedicated IP might be worth looking into.

Otherwise, you do have an option to set up HubSpot so it would send marketing emails from a sub-domain (i.e. @newsletter.yourcomany.com) which would keep a separate reputation from your main domain (i.e. yourcomany.com) - if that is a concern.

Re: DKIM and DMARC Setup

Timbrowntown — Wed, 17 Apr 2024 14:44:00 GMT

Excellent answer. I'll communicate this to our Marketing team. Thank you so much!