SendGrid email authentication: SPF, DKIM and DMARC
SendGrid authenticates a sending domain with three CNAME records and, by default, does the SPF and DKIM work for you through them. That changes the merge question: with automated security on there is usually no SendGrid include to add to your SPF record.
Record values checked against SendGrid’s own documentation on 2026-11-10. Every section links its source.
Check your domain against SendGrid
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
SPF for SendGrid
Nothing to add to your own SPF record for SendGrid in the standard setup. The notes below explain why, and what to do if your setup differs.
- By default Twilio SendGrid turns on automated security. SendGrid then manages SPF authentication (and DKIM signing) through the CNAME records, so you add nothing to your own SPF TXT record.
- If you turn automated security off, the doc’s example SPF record is v=spf1 include:sendgrid.net ~all. Measured on the verification date that include costs 2 DNS lookups.
- Turn automated security off only if your DNS host does not accept underscores in CNAME records. With it off you manage SPF and DKIM records by hand.
DKIM for SendGrid
Where: Twilio SendGrid console: Settings > Sender Authentication > Authenticate Your Domain
- In the SendGrid console open Settings > Sender Authentication and start domain authentication for your domain.
- Keep automated security on unless your DNS host rejects underscores in CNAME names.
- Copy the three CNAME records from the Install DNS Records step and publish them at your DNS host.
- Return to SendGrid and verify. DKIM signing now uses s1 and s2 under your domain.
| Type | Name | Value |
|---|---|---|
| CNAME | s1._domainkey | s1.domainkey.u<id>.wl<id>.sendgrid.netThe u and wl numbers are specific to your account; copy the value from SendGrid. |
| CNAME | s2._domainkey | s2.domainkey.u<id>.wl<id>.sendgrid.net |
Selector. SendGrid signs with the selectors s1 and s2 when automated security is on.
- The branded URL CNAME (em<number>.<your-domain>) is listed under Additional records.
DMARC with SendGrid
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- DKIM signing happens on s1 and s2 under your own domain, so DKIM can align with your From domain. Send a test message and read the Authentication-Results header to confirm before you tighten DMARC.
- SendGrid creates a subdomain of your domain for bounce and unsubscribe notices. A custom return path lets you choose its label; check that no existing CNAME of the same name is overwritten.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Branded URL and return path
The Install DNS Records step also lists a branded URL CNAME. Separately, SendGrid creates a subdomain of your domain to handle bounce and unsubscribe notices; by default its label is four random alphanumeric characters, and a custom return path lets you choose it.
| Type | Name | Value |
|---|---|---|
| CNAME | em<number> | u<id>.wl<id>.sendgrid.netBranded URL, as shown on the Install DNS Records step. The numbers are specific to your account. |
| CNAME | <custom return-path label> | sendgrid.netOnly with a custom return path. A custom CNAME that matches an existing one overwrites it, so check your existing records first. |
Common SendGrid mistakes
- Adding include:sendgrid.net to your root SPF record while automated security is on. It costs lookups and does nothing for SendGrid.
- Turning automated security off just to follow an old tutorial, and then forgetting to maintain the SPF and DKIM records by hand.
- Letting a custom return-path label overwrite an existing CNAME on your domain.
- Tightening DMARC to reject before a test message shows aligned DKIM.
SendGrid email authentication FAQ
Do I add include:sendgrid.net to my SPF record?
Not with automated security on, which is the default. SendGrid then handles SPF through the CNAME records. The include appears in the doc only as the example for the manual route.
Which DKIM selectors does SendGrid use?
s1 and s2, as CNAMEs at s1._domainkey and s2._domainkey that point to s1.domainkey.u<id>.wl<id>.sendgrid.net and the matching s2 host.
Where do I start domain authentication in SendGrid?
In the Twilio SendGrid console under Settings > Sender Authentication.
What if my DNS host does not allow underscores in CNAME records?
Twilio says to turn automated security off in that case. You then publish the SPF and DKIM records manually.
Can I have SPF records for both SendGrid and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my SendGrid authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.