How to Set Up DKIM for SendGrid

Configure DKIM for SendGrid by publishing CNAME records that allow SendGrid to sign outgoing email with your domain.

Quick Answer — The Record You Need

Record Type

CNAME

Host / Name

s1._domainkey

Value

s1.domainkey.u12345678.wl12345.sendgrid.net

You need two CNAME records: s1._domainkey and s2._domainkey. The exact values are generated in your SendGrid account during domain authentication.

Step-by-Step Setup

Log in to SendGrid

Go to app.sendgrid.com and sign in to your account.

Navigate to domain authentication

Go to Settings > Sender Authentication > Domain Authentication. Click "Authenticate Your Domain".

Enter your domain details

Select your DNS host, enter your domain, and optionally customize the DKIM selector prefix (default is s1 and s2).

Add the CNAME records to your DNS

SendGrid will display the CNAME records. Create both CNAME records in your DNS provider.

s1._domainkey.yourdomain.com  CNAME  s1.domainkey.u12345678.wl12345.sendgrid.net
s2._domainkey.yourdomain.com  CNAME  s2.domainkey.u12345678.wl12345.sendgrid.net

Verify in SendGrid

Click "Verify" in SendGrid. Once DNS records propagate, SendGrid will confirm DKIM is active and begin signing outgoing email.

Common Gotchas

SendGrid DKIM uses CNAME records, not TXT records. The CNAMEs point to SendGrid-hosted keys.
The s1 and s2 selectors are SendGrid defaults. The exact CNAME values are unique to your account and cannot be guessed -- you must copy them from the SendGrid dashboard.
If you have an existing DKIM TXT record at the same selector, it may conflict with the CNAME. Remove the old TXT record before adding the CNAME.

Verify Your Setup

After adding your DNS records, use our free DKIM checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What are the DKIM selectors for SendGrid?

SendGrid uses s1 and s2 as default DKIM selectors. The records are published as CNAME records at s1._domainkey.yourdomain.com and s2._domainkey.yourdomain.com.

Does SendGrid rotate DKIM keys?

SendGrid manages the DKIM keys on their end. Because the records are CNAMEs, SendGrid can update the underlying keys without requiring DNS changes from you.

Can I customize the DKIM selector for SendGrid?

Yes. During domain authentication setup, you can choose a custom selector prefix instead of the default s1/s2.