Set up SPF, DKIM and DMARC for SendGrid

Records at a glance

With automated security off, SendGrid gives you records to manage yourself instead:

Set up SPF for SendGrid

You don’t need include:sendgrid.net in your root domain’s SPF record. After domain authentication, SendGrid uses the em#### subdomain as the envelope sender, and SPF is checked there. With automated security on, that subdomain is a CNAME to SendGrid, so SendGrid maintains its SPF and MX for you. With it off, you publish v=spf1 include:sendgrid.net ~all on the subdomain yourself.

As of September 2026, include:sendgrid.net costs two DNS lookups (it nests ab.sendgrid.net). If you do add it to a root record, for example because you relay through SendGrid from a system that uses your root domain as the envelope sender, merge it into your one existing record:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all

If you use DMARC Dojo’s hosted SPF, you add SendGrid in the dashboard instead of editing DNS, and changes that would exceed the 10-lookup limit are refused.

Set up DKIM with Domain Authentication

1. In the SendGrid app, go to Settings > Sender Authentication and choose Get Started under Domain Authentication.
2. Choose your DNS host and whether to brand links (see below).
3. Enter the domain you send From, for example example.com.
4. Under Advanced Settings, leave Use automated security checked unless you have a reason to manage SPF and DKIM records yourself. Optionally choose Use custom return path (a label instead of em####) or Use a custom DKIM selector if another service already uses s1/s2.
5. Add the records SendGrid shows at your DNS host, then click Verify. SendGrid says verification can take up to 48 hours after you publish them.

The CNAMEs let SendGrid rotate DKIM keys without you touching DNS. To confirm signing, send a test and check for dkim=pass with header.d= your domain in the Authentication-Results header.

Make it pass DMARC (alignment)

• Nothing aligns before domain authentication. SendGrid signs with its own domain and uses a sendgrid.net return path, so both SPF and DKIM pass for SendGrid, not for you.
• After domain authentication, both align. DKIM signs with d=example.com, and the return path em####.example.com aligns with example.com under relaxed SPF alignment, the DMARC default.

Authenticate the exact domain you use in the From address (or its parent). If you send from news.example.com and authenticated example.com, relaxed alignment still works; with adkim=s or aspf=s it doesn’t. Subusers have their own authenticated domains, so make sure each subuser that sends has one. DMARC alignment covers the rules.

Add a DMARC record

SendGrid’s setup includes a basic v=DMARC1; p=none; record. If you already have a DMARC record, keep yours and don’t add a second one: two DMARC records cancel each other out. Make sure it has a report address:

v=DMARC1; p=none; rua=mailto:<your report address>

DMARC Dojo recognizes SendGrid in DMARC reports, so you can see SendGrid traffic on its own and check it passes with alignment before you move to quarantine and reject.

Troubleshooting

• Verification fails on every record. Your DNS host appended the domain, creating em1234.example.com.example.com. Enter only the part before your domain.
• DKIM fails through Cloudflare. Set the CNAMEs to DNS only. Proxied records don’t return SendGrid’s targets.
• Reports still show d=sendgrid.net. Mail is going out from a subuser, or from a From domain that isn’t the one you authenticated. Authenticate that domain or subuser too.
• Two DMARC records after setup. You added SendGrid’s _dmarc record next to an existing one. Delete one so exactly one remains.
• Selector conflict. Another service already publishes s1._domainkey. Redo the setup with a custom DKIM selector.