The short version

Mail HubSpot sends from your domain passes DMARC only when it is DKIM signed with your domain, or sent with a bounce address on your domain. Set up DKIM first: it is the fix that survives forwarding.

1. DKIM with your domain

Connect the email sending domain in HubSpot (Settings > Domains & URLs) and publish the hs1/hs2._domainkey CNAMEs.

HubSpot's own instructions: HubSpot documentation.

2. SPF

Adding include:_spf.hubspotemail.net to your SPF record makes SPF pass, but for DMARC it counts only when HubSpot sends with a bounce (return-path) address on your domain. Where it offers a custom return-path, set one up; otherwise rely on DKIM, and leave the include out to save SPF lookups.

example.com.  TXT  "v=spf1 include:_spf.hubspotemail.net ~all"

Merge it into your one existing SPF record rather than adding a second, and keep the total under 10 lookups: the SPF Check counts them.

3. Check it worked

  1. Send a message through HubSpot to an outside mailbox and open its headers. The DKIM-Signature should show d=example.com, your domain; its s= tag is the selector.
  2. Look the selector up with the DKIM Inspector to confirm the key is published.
  3. In your DMARC reports, HubSpot's traffic should now pass DMARC. In DMARCLoop it moves from Known sender, failing to Compliant on the domain's Sources tab.

4. DMARC

If your domain has no DMARC record yet, publish one at p=none with a report address, so you can see every service sending as your domain before you tighten the policy. Build it with the DMARC Record Wizard, and see how to publish a DMARC record for the path to p=reject: quarantine by day 30, reject from day 60.

Other services like HubSpot