How to Set Up DMARC for SendGrid

Publish a DMARC policy to protect your domain when using SendGrid, ensuring that spoofed email is handled according to your policy.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Ensure SendGrid domain authentication is complete (SPF + DKIM aligned) before enforcing DMARC.

Step-by-Step Setup

Complete SendGrid domain authentication

DMARC requires SPF or DKIM to pass with alignment. Complete SendGrid's domain authentication first, which sets up both SPF and DKIM with your domain.

Verify alignment

Send a test email through SendGrid and check the email headers. The DKIM d= domain and SPF envelope sender should match your From domain.

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com with your initial monitoring policy.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Monitor reports

Review DMARC aggregate reports for 2-4 weeks to confirm SendGrid emails are passing authentication.

Enforce the policy

After confirming alignment, move to p=quarantine and then p=reject.

Common Gotchas

SendGrid emails will only align with DMARC if you have completed domain authentication. Without it, the envelope sender and DKIM d= domain will be sendgrid.net, not your domain.
If you use SendGrid alongside other email providers, ensure all providers are authenticated before moving to p=reject.
SendGrid link tracking can affect DKIM alignment if not configured correctly. Ensure link branding is set up alongside domain authentication.

Verify Your Setup

After adding your DNS records, use our free DMARC checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

Do I need DMARC if I use SendGrid domain authentication?

Yes. Domain authentication handles SPF and DKIM, but DMARC tells receivers what to do when those checks fail. DMARC is a separate DNS record that complements SPF and DKIM.

Why are my SendGrid emails failing DMARC?

The most common cause is incomplete domain authentication. Without it, SendGrid sends with its own domain in the envelope sender and DKIM signature, causing alignment failure.

Can I use DMARC with SendGrid's shared IP addresses?

Yes. DMARC relies on domain alignment, not IP addresses. As long as domain authentication is complete, DMARC works with both shared and dedicated IPs.