Setup guide
SendGrid: SPF, DKIM and DMARC
With automated security on (the default), SendGrid gives you three CNAME records that cover SPF and DKIM, plus a DMARC TXT record.
By Ahmet Karaca · Updated · Checked against SendGrid documentation on
DNS records to add
<em1234><u1234.wl.sendgrid.net from SendGrid>Get this value from your provider's dashboard.Return-path subdomain that makes SPF align
s1._domainkey<s1 target from SendGrid>Get this value from your provider's dashboard.DKIM key 1
s2._domainkey<s2 target from SendGrid>Get this value from your provider's dashboard.DKIM key 2
_dmarcv=DMARC1; p=none; rua=mailto:<your report address>Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.
DMARC policy and reports
Steps
- In SendGrid open Settings → Sender Authentication and click Get Started under Domain Authentication.
- Pick your DNS host, enter only your root domain under Domain You Send From, and leave Use automated security checked in Advanced Settings.
- Publish the three CNAME records and the DMARC TXT record from the Install DNS Records page, then click Verify.
- If GoDaddy hosts your DNS and you aren't using link branding, Automated Setup can publish the records for you through Domain Connect.
Common mistakes
- GoDaddy, Namecheap and other hosts append your domain to the host you enter, so a pasted full name never verifies. Enter only the hostname part SendGrid shows, without your domain.
- Automated security relies on underscores in CNAME names. If your DNS provider rejects them, turn automated security off and publish the manual records instead.
- If another service already uses SendGrid's s selector, the DKIM records collide. Set a custom DKIM selector when you authenticate the domain.
- SendGrid applies your authenticated domain only when the From address domain matches it, so mail sent from any other domain isn't covered by that authentication.
Good to know
- With automated security off, SendGrid instead gives you an MX and an SPF TXT record (include:sendgrid.net) on the em subdomain and a DKIM TXT record at m1._domainkey, and you must update them yourself when your setup changes.
- If your DNS host is Cloudflare, set the CNAMEs to DNS only (grey cloud).
Frequently asked questions
What should I do if SendGrid still hasn't verified my domain after 48 hours?
Contact SendGrid support. Verification can take up to 48 hours after you publish the records, so wait that long first.
Does authenticating my domain remove "via sendgrid.net"?
Yes. Domain authentication removes the via sendgrid.net tagline from your From address.
Can I choose the return-path subdomain in SendGrid?
Yes. Check Use a custom return path and enter your own alphanumeric subdomain instead of the random default.
Is there a limit on authenticated domains in SendGrid?
Yes. Each user can have up to 3,000 authenticated domains and 3,000 link brandings.
Is link branding required?
No. Link branding is optional and is configured separately from domain authentication.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: SendGrid documentation.
Check your SendGrid setup
Or open the SPF checker, DKIM checker or DMARC checker directly.