SendGrid: set up SPF, DKIM and DMARC

To authenticate a domain in Twilio SendGrid, run Domain Authentication (Sender Authentication) and add the CNAME records it generates — typically three: two DKIM CNAMEs at s1._domainkey and s2._domainkey, plus a mail/return-path CNAME like em1234.yourdomain.com — then publish a DMARC record at _dmarc. With SendGrid's default Automated Security, those CNAMEs let SendGrid manage SPF and DKIM for you, and the DKIM signature aligns with your domain for DMARC. Every target is account-specific, so copy the records from your own SendGrid setup screen.

Step 1 — Domain Authentication (the CNAMEs)

In SendGrid, go to Settings → Sender Authentication → Authenticate Your Domain, choose your DNS host and your domain, and keep Automated Security on (the default). SendGrid generates CNAME records shaped like this:

Host:  em1234.yourdomain.com
Value: u1234567.wl123.sendgrid.net

Host:  s1._domainkey.yourdomain.com
Value: s1.domainkey.u1234567.wl123.sendgrid.net

Host:  s2._domainkey.yourdomain.com
Value: s2.domainkey.u1234567.wl123.sendgrid.net

The em, u, and wl values are unique to your SendGrid account — use the exact records from your own screen, not these placeholders. Add all of them as CNAME records, then click Verify in SendGrid.

With Automated Security on, SendGrid publishes and rotates the SPF and DKIM behind these CNAMEs, and the DKIM signature carries d=yourdomain.com so DMARC aligns. (If you turn Automated Security off, SendGrid gives you TXT records to add manually instead.)

SendGrid's official instructions: How to set up domain authentication.

Step 2 — SPF

With Automated Security enabled you do not add a SendGrid include to your own SPF record — the em1234 CNAME points the return-path at a SendGrid domain that carries its own SPF. Keep your existing SPF for the services that send as your domain and stay within the 10-lookup limit; confirm it with the SPF lookup counter.

Step 3 — DMARC

Publish a TXT record at host _dmarc:

Start at p=none, verify from the aggregate reports that SendGrid mail is passing and aligned via DKIM, and only then tighten to p=quarantine and p=reject. Validate the record and preview a safe next step in the DMARC record checker.

Where to add these records

The authentication records are CNAME; the DMARC record is TXT. All go in your domain's DNS zone at your registrar or DNS host:

• Enter only the host prefix SendGrid shows (s1._domainkey, em1234) — most panels append your domain.
• A CNAME's value must be a bare hostname with no http:// and no trailing slash.

DNS changes can take a few hours to propagate before SendGrid can verify them.

Verify it worked

SendGrid marks the domain verified once the CNAMEs resolve. Send a test message, open the raw headers, and confirm dkim=pass with d=yourdomain.com and dmarc=pass. To see DKIM presence and DMARC alignment in one place, run a scan of your domain below.