Twilio SendGrid is a cloud-based transactional and marketing email platform. This guide covers the complete email authentication stack for SendGrid: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.
Authorize SendGrid to send email on behalf of your domain by adding the correct SPF include or by completing domain authentication.
TXT
@
v=spf1 include:sendgrid.net ~all
If using SendGrid domain authentication (recommended), SPF is handled automatically via a CNAME record. Manual SPF include is the alternative.
Go to app.sendgrid.com and sign in to your account.
Navigate to Settings > Sender Authentication > Domain Authentication. Click "Authenticate Your Domain". SendGrid recommends domain authentication over manual SPF.
Choose your DNS provider from the dropdown and enter your sending domain. SendGrid will generate the DNS records you need.
SendGrid will provide CNAME records that handle SPF automatically. If you prefer a manual SPF include instead, add include:sendgrid.net to your SPF record.
v=spf1 include:sendgrid.net ~allClick "Verify" in SendGrid. The platform will check your DNS records and confirm authentication is complete.
v=spf1 include:_spf.google.com ~allv=spf1 include:_spf.google.com include:sendgrid.net ~allIf using manual SPF, add include:sendgrid.net to your SPF record. If using SendGrid domain authentication (recommended), SPF is handled via CNAME records and no manual SPF include is needed.
SendGrid recommends domain authentication. It uses CNAME records that automatically handle SPF and DKIM, and it gives you better control over your sender reputation.
Yes. Combine both includes in a single SPF record: v=spf1 include:_spf.google.com include:sendgrid.net ~all.
Configure DKIM for SendGrid by publishing CNAME records that allow SendGrid to sign outgoing email with your domain.
CNAME
s1._domainkey
s1.domainkey.u12345678.wl12345.sendgrid.net
You need two CNAME records: s1._domainkey and s2._domainkey. The exact values are generated in your SendGrid account during domain authentication.
Go to app.sendgrid.com and sign in to your account.
Go to Settings > Sender Authentication > Domain Authentication. Click "Authenticate Your Domain".
Select your DNS host, enter your domain, and optionally customize the DKIM selector prefix (default is s1 and s2).
SendGrid will display the CNAME records. Create both CNAME records in your DNS provider.
s1._domainkey.yourdomain.com CNAME s1.domainkey.u12345678.wl12345.sendgrid.net
s2._domainkey.yourdomain.com CNAME s2.domainkey.u12345678.wl12345.sendgrid.netClick "Verify" in SendGrid. Once DNS records propagate, SendGrid will confirm DKIM is active and begin signing outgoing email.
SendGrid uses s1 and s2 as default DKIM selectors. The records are published as CNAME records at s1._domainkey.yourdomain.com and s2._domainkey.yourdomain.com.
SendGrid manages the DKIM keys on their end. Because the records are CNAMEs, SendGrid can update the underlying keys without requiring DNS changes from you.
Yes. During domain authentication setup, you can choose a custom selector prefix instead of the default s1/s2.
Publish a DMARC policy to protect your domain when using SendGrid, ensuring that spoofed email is handled according to your policy.
TXT
_dmarc
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
Ensure SendGrid domain authentication is complete (SPF + DKIM aligned) before enforcing DMARC.
DMARC requires SPF or DKIM to pass with alignment. Complete SendGrid's domain authentication first, which sets up both SPF and DKIM with your domain.
Send a test email through SendGrid and check the email headers. The DKIM d= domain and SPF envelope sender should match your From domain.
Add a TXT record at _dmarc.yourdomain.com with your initial monitoring policy.
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1Review DMARC aggregate reports for 2-4 weeks to confirm SendGrid emails are passing authentication.
After confirming alignment, move to p=quarantine and then p=reject.
Yes. Domain authentication handles SPF and DKIM, but DMARC tells receivers what to do when those checks fail. DMARC is a separate DNS record that complements SPF and DKIM.
The most common cause is incomplete domain authentication. Without it, SendGrid sends with its own domain in the envelope sender and DKIM signature, causing alignment failure.
Yes. DMARC relies on domain alignment, not IP addresses. As long as domain authentication is complete, DMARC works with both shared and dedicated IPs.
Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.