SendGrid SPF, DKIM and DMARC Setup

SendGrid aligns for DMARC once you complete domain authentication under Settings, then Sender Authentication. With automated security on (the default), you publish three CNAMEs: em1234 for the return path and SPF, and s1._domainkey and s2._domainkey for DKIM. Both SPF and DKIM then align under relaxed DMARC. SendGrid says verification can take up to 48 hours.

The records at a glance

With automated security on, SendGrid's domain authentication guide shows records of this shape. The numbers are specific to your account.

The setup screen also offers the DMARC TXT record. If your domain already has a DMARC record, keep yours. A domain can have only one.

For a real example, on 19 October 2026 s1._domainkey.github.com pointed to s1.domainkey.u51742174.wl175.sendgrid.net.

Where to do it in SendGrid

1. In the SendGrid console, go to Settings, then Sender Authentication.
2. Under Domain Authentication, click Get Started.
3. Pick your DNS host from the list (or Other Host (Not Listed)) and choose whether to brand links too.
4. In Domain You Send From, type only the root domain, for example example.com. SendGrid notes that subdomains do not inherit authentication from the parent.
5. Open Advanced Settings and review the options below.
6. Click Next. Copy the records from the Install DNS Records page to your DNS host.
7. Come back and click Verify.

If your domain is on GoDaddy, SendGrid can write the records itself through Domain Connect. That only works with automated security on and link branding off.

Advanced Settings worth knowing

• Use automated security. On by default. SendGrid manages SPF and DKIM through the CNAMEs and updates them when, for example, you add a dedicated IP. Turn it off only if your DNS host does not accept underscores in CNAME names.
• Use custom return path. Changes the em1234 label to a name you choose, such as bounces. It is still a subdomain of your domain.
• Use a custom DKIM selector. For when another service already uses s1 or s2. SendGrid asks for three characters.
• Make domain EU-pinned. Required for SendGrid's EU regional customers. SendGrid says it needs the Email API Pro or Marketing Campaigns Advanced plan, or higher.

SPF: handled by the return-path CNAME

SendGrid uses the em1234 subdomain as the return path. That is the address bounces go to, and the domain SPF is checked against. Because em1234.example.com is a CNAME into SendGrid, SendGrid controls its SPF answer. You do not add anything to your root SPF record.

This catches people out. In our scan of the Tranco top 1,000 domains on 19 October 2026, 47 root SPF records contained include:sendgrid.net. With domain authentication in place, that include does nothing for SendGrid mail. It costs DNS lookups toward the limit of 10 in RFC 7208. Run your domain through the SPF checker and remove it if SendGrid is the only reason it is there.

With automated security off, SendGrid gives you an MX and a TXT record on the same em1234 subdomain instead:

em1234.example.com  MX   mx.sendgrid.net.
em1234.example.com  TXT  "v=spf1 include:sendgrid.net ~all"

You then maintain them yourself, including when your sending IPs change.

DKIM: s1 and s2

SendGrid's DKIM page says it uses s1 and s2 by default and rotates between them. Only one signs at any moment. Keep both CNAMEs in place forever, or a rotation will break signing.

Since the CNAMEs point into SendGrid, the public key lives on SendGrid's side and you never paste it. With automated security off, you get a single TXT record at m1._domainkey holding the key (k=rsa; t=s; p=...), and key changes become your job.

The host-name trap

SendGrid warns about this one by name. GoDaddy, Amazon Route 53 and Namecheap append your domain to whatever you type in the host field. Paste em1234.example.com and the record becomes em1234.example.com.example.com, which fails verification. Type only em1234, s1._domainkey and s2._domainkey.

If Verify shows only some records passing, SendGrid's advice is to wait, then check the failing ones for a typo. DNS changes can take up to 48 hours.

How SendGrid aligns for DMARC

• DKIM alignment. After authentication, SendGrid signs with d=example.com, matching the From domain. Aligned under relaxed and strict.
• SPF alignment. The return path is em1234.example.com. Under relaxed alignment, the default, a subdomain of the From domain counts, so SPF aligns. Under aspf=s it does not.

SendGrid's own record shows the relaxed setting in use. On 19 October 2026, _dmarc.sendgrid.com published p=reject with adkim=r; aspf=r.

Domain authentication also removes the "via sendgrid.net" tagline (or "via eu.sendgrid.net" for EU customers) that otherwise appears after your From address.

DMARC record

If you have no DMARC record yet, start at p=none and collect reports:

_dmarc  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

The DMARC generator writes the record. Once reports arrive, the DMARC analyzer lists SendGrid's sending IPs next to your other sources so you can see each one pass or fail.

Checking the result

Send a test through SendGrid to Gmail and open Show original. You want DKIM: PASS with d= your domain, SPF: PASS on the em1234 subdomain, and DMARC: PASS.

Check from outside with the DKIM checker (and selector=s2), the SPF checker on your root domain to confirm the lookup count, and the DMARC checker.

Frequently asked questions

Sources

• Twilio SendGrid Docs: Configure domain authentication
• Twilio SendGrid Docs: DKIM records
• RFC 7489: DMARC (identifier alignment)
• RFC 7208: Sender Policy Framework (10 DNS lookup limit)