Setup guide

SPF · DKIM · DMARC

Set up SPF, DKIM and DMARC on SendGrid

SendGrid authenticates a sending subdomain with CNAMEs it generates for you — publish them, add DMARC, click Verify, then confirm it landed.

Check your setup free → SendGrid docs ↗

Before you start

What SendGrid needs from your DNS.

SendGrid is a sending platform, not your mailbox host. It sends on your behalf from a dedicated subdomain, and receivers judge that mail on what your DNS says — not on the fact that SendGrid carried it. Domain authentication is how you tell them SendGrid is allowed to send as you: it sets up SPF and DKIM against a subdomain like em1234.yourdomain.com so messages align with the address your recipients see.

Unlike a mailbox provider, SendGrid does not hand you one SPF line to paste. With Automated Security — the default and recommended path — it generates CNAME records that point back into SendGrid, one for the mail stream and return path and two for DKIM under the s1 and s2 selectors. Because they are CNAMEs, SendGrid can rotate the underlying SPF and DKIM keys without you touching DNS again. The values are unique to your account, so there is nothing generic to copy from a guide — you take them from the SendGrid console.

DMARC is the one record SendGrid does not manage for you on the default plan beyond a starter policy. It belongs on your root domain as a TXT record, ties SPF and DKIM back to the domain your recipients see, and tells receivers what to do on failure. Since February 2024 Google and Yahoo require bulk senders to publish all three, so authenticating your SendGrid domain is the gate to the inbox, not an optional polish.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not SendGrid. Then run the checker to confirm every one resolves.

SPF / return-path (CNAME) record

host  em1234 type  CNAME

value generated by SendGrid

SendGrid generates the exact host (em plus digits) and the target (u12345.wl123.sendgrid.net) when you start domain authentication — copy both from the console. This CNAME carries SPF and the return path for the sending subdomain. If you disabled Automated Security, SendGrid instead gives you a TXT record of v=spf1 include:sendgrid.net ~all on that subdomain; where you already run SPF on the same name, add include:sendgrid.net to the existing line rather than publishing a second record.

DKIM selector 1 (CNAME) record

host  s1._domainkey type  CNAME

value generated by SendGrid

Points to s1.domainkey.u12345.wl123.sendgrid.net — the exact target is generated per account, so take it from the console. SendGrid uses two selectors, s1 and s2, so it can rotate keys without downtime; publish both.

DKIM selector 2 (CNAME) record

host  s2._domainkey type  CNAME

value generated by SendGrid

The second DKIM CNAME, pointing to s2.domainkey.u12345.wl123.sendgrid.net. It is not optional — both s1 and s2 must resolve or SendGrid marks domain authentication as failed.

DMARC record

host  _dmarc type  TXT 
v=DMARC1; p=none; rua=mailto:[email protected]

Publish this once on your root domain, not on the SendGrid subdomain. Start at p=none to watch who sends as you, then raise to quarantine and reject once your reports show every legitimate sender aligning. Point rua at an address you actually read.

Step by step

The whole setup, in order.

  1. 1 Start domain authentication in SendGrid. In the SendGrid console go to Settings → Sender Authentication → Authenticate Your Domain. Choose your DNS host, enter your sending domain, and leave Automated Security on unless you have a specific reason to manage SPF and DKIM by hand.
  2. 2 Copy the generated records. SendGrid produces three CNAMEs — one em subdomain for the mail stream and return path, and s1._domainkey and s2._domainkey for DKIM. The hosts and targets are unique to your account, so copy each exactly from the console rather than from any guide.
  3. 3 Publish the CNAMEs at your DNS host. At your registrar or DNS provider — not in SendGrid — add all three CNAME records exactly as shown. Do not append your domain twice; some panels add it automatically, which turns em1234.yourdomain into em1234.yourdomain.yourdomain.
  4. 4 Publish DMARC on your root domain. Add the _dmarc TXT record above at the root of your domain. Begin at p=none so you break nothing while you read the reports, and keep the rua address pointed somewhere you will see it.
  5. 5 Click Verify in SendGrid. Return to the Sender Authentication page and click Verify. SendGrid checks the CNAMEs resolve; if they do not, it tells you which record is missing. Verification can take up to 48 hours after you publish, though it is often much faster.
  6. 6 Confirm with a full check. Once SendGrid shows the domain as verified, run a full check here to confirm the s1 and s2 selectors resolve, SPF stays under the 10-lookup limit, and DMARC is graded.

Where it goes wrong

The mistakes specific to SendGrid.

Records published as TXT instead of CNAME Automated Security hands you CNAMEs, not TXT records. Pasting the target into a TXT record leaves DKIM unresolvable. Match the record type SendGrid shows exactly.
The domain appended twice Many DNS panels add your domain automatically. Entering em1234.yourdomain.com as the host then produces em1234.yourdomain.com.yourdomain.com. Enter only the subdomain part (em1234, s1._domainkey, s2._domainkey) when the panel appends the rest.
Only one DKIM selector published SendGrid needs both s1._domainkey and s2._domainkey to resolve. Publishing one and skipping the other fails verification even though half the DKIM setup looks correct.
Replacing your mailbox SPF SendGrid authenticates a sending subdomain and does not replace the SPF of the domain your staff send from. If you also run manual security, add include:sendgrid.net to the existing SPF rather than overwriting it with SendGrid only.
DMARC put on the subdomain DMARC belongs at _dmarc on your root domain, where it covers the organisational domain. Publishing it only on the em subdomain leaves your main domain without a policy.
Verifying too soon Clicking Verify minutes after publishing can show a failure that is only propagation. SendGrid allows up to 48 hours for the CNAMEs to be detected — give it time before concluding anything is wrong.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the SendGrid DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About SendGrid, specifically.

What is the SendGrid SPF record? With Automated Security, SendGrid does not give you an SPF text string to paste — it authorises sending through a generated CNAME on your em subdomain. If you turn Automated Security off, it provides a TXT record of v=spf1 include:sendgrid.net ~all on that subdomain instead. Where you already run SPF on the same name, add include:sendgrid.net to the existing line rather than publishing a second record.
What are the SendGrid DKIM selectors? s1 and s2, so the records live at s1._domainkey and s2._domainkey on your sending subdomain. Both are CNAMEs pointing back into SendGrid, which lets it rotate keys without you editing DNS. Publish both — one alone fails verification.
Why is my SendGrid DKIM failing? Usually one of a few things: you published the records as TXT instead of CNAME; your DNS panel appended your domain twice so the host is wrong; you published only one of the two selectors; or you are checking before the CNAMEs have propagated. SendGrid allows up to 48 hours to detect them.
Do I need DMARC for SendGrid? Yes if you send in bulk to Gmail or Yahoo — both have required it since February 2024. SendGrid can publish a starter p=none record, but DMARC belongs on your root domain, not the sending subdomain. Start at p=none with a report address, then move to quarantine and reject once your reports show every legitimate sender aligning.
Should I use Automated Security or manual security? Automated Security is the default and the recommended choice: SendGrid manages SPF and DKIM through CNAMEs and rotates the underlying keys for you. Choose manual security only if you must control the raw SPF and DKIM TXT values yourself, in which case SendGrid gives you an MX record and TXT records instead.
Where do I add these records — in SendGrid or at my registrar? At your DNS host: the registrar or provider that controls your domain's DNS. SendGrid generates the CNAME hosts and targets, but every record is published in your own DNS. After publishing, return to SendGrid and click Verify.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring