Skip to content
inboxprobe

Checkers

Generators

Guides

Guides

SPF, DKIM and DMARC for SendGrid

Twilio SendGrid authenticates your domain with three CNAME records plus a DMARC record. SPF lives on a subdomain SendGrid creates, so you don't edit your main SPF record.

The records (automated security on)

Automated security is on by default. SendGrid then hosts the SPF and DKIM details and keeps them up to date; your DNS just points to them. The parts in angle brackets are specific to your account: copy them from the SendGrid console.

Return path (SPF)

Type
CNAME
Host / name
em<number>
Value
<u-number>.<wl-number>.sendgrid.net

DKIM

Type
CNAME
Host / name
s1._domainkey
Value
s1.domainkey.<u-number>.<wl-number>.sendgrid.net

DKIM

Type
CNAME
Host / name
s2._domainkey
Value
s2.domainkey.<u-number>.<wl-number>.sendgrid.net

DMARC (SendGrid's example)

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none;

Already have a DMARC record? Keep it and skip SendGrid's: a domain must have exactly one. If you want reports, a version with an address is better: v=DMARC1; p=none; rua=mailto:[email protected]. The DMARC generator builds one.

With automated security off

Turn automated security off only if you need to, for example when your DNS host won't accept underscores in CNAME names. SendGrid then gives you the records to publish directly, and you have to update them yourself whenever your SendGrid configuration changes:

TypeHostValue
MXem<number>mx.sendgrid.net
TXTem<number>v=spf1 include:sendgrid.net ~all
TXTm1._domainkeyk=rsa; t=s; p=<key shown in SendGrid>
TXT_dmarcv=DMARC1; p=none;

Why you don't touch your main SPF record

SendGrid uses the em… subdomain as the bounce (Return-Path) address of your mail, and that's where SPF is checked. Because em1234.yourdomain.com is part of your domain, SPF lines up with your From address for DMARC, without spending any of the 10 lookups in your root SPF record.

SendGrid's instructions don't ask you to add include:sendgrid.net to your root record. If it's there from an old setup and you only send through authenticated domains, it isn't needed for SendGrid. Remove it only after checking nothing else relies on it; the SPF checker shows what each include costs.

Options worth knowing

  • Automatic setup: SendGrid can publish the records for you through Domain Connect, but only for domains hosted at GoDaddy, with automated security on and without link branding.
  • Custom DKIM selector: use it if another service already uses SendGrid's selector, s.
  • Link branding (your domain in tracked links) is separate and optional. SendGrid says it needs the Email API Pro or Marketing Campaigns Advanced plan or higher.
  • Dedicated IP: SendGrid adds it to the SPF record it hosts for you.

Questions

Do I need to add include:sendgrid.net to my SPF record?

Not for an authenticated domain. SPF is checked on the em… subdomain SendGrid sets up, and with automated security on SendGrid maintains it. Only the manual setup has an SPF record, and it goes on em…, not on your root domain.

SendGrid won't verify my records.

Give DNS a little time, then look for the doubled-domain mistake: some DNS hosts append your domain to the name (em1234.yourdomain.com.yourdomain.com). At Cloudflare, set the CNAMEs to DNS only. The DKIM checker with selector s1 shows whether the key resolves.

What selector do I enter in the DKIM checker?

s1 or s2 with automated security on, m1 with it off, or your custom selector if you set one.

Is SendGrid's DMARC record enough?

v=DMARC1; p=none; meets the minimum Gmail and Yahoo ask for, but it has no report address, so you can't see who sends as your domain. Add a rua address, and move to quarantine once reports look clean.

Sources

Last reviewed: