Twilio SendGrid SPF and DKIM setup

What you are setting up

SendGrid (now Twilio SendGrid) sends your application and marketing mail. Its Domain Authentication flow sets up SPF and DKIM together using CNAME records, so that SendGrid signs with your domain and routes bounces through a subdomain of yours. Both halves then align, and your mail passes DMARC. You publish a handful of CNAMEs; SendGrid manages the actual keys behind them.

Run Domain Authentication

In SendGrid, go to Settings > Sender Authentication and, under Domain Authentication, click Get Started. Choose your DNS host, enter your sending domain, and leave Automated Security on (the default). SendGrid then generates three CNAME records and a DMARC TXT record:

Type:  CNAME
Host:  em1234.yourdomain.com           (the mail / return-path subdomain)
Value: (copy the exact target SendGrid shows)

Type:  CNAME
Host:  s1._domainkey.yourdomain.com    (DKIM)
Value: (copy the exact target SendGrid shows)

Type:  CNAME
Host:  s2._domainkey.yourdomain.com    (DKIM)
Value: (copy the exact target SendGrid shows)

Type:  TXT
Host:  _dmarc.yourdomain.com           (DMARC; keep yours if you already have one)
Value: (SendGrid's suggested record, or your own; see below)

The em1234 record provides an aligned return-path so SPF passes for your domain; the two s1 and s2 DKIM records let SendGrid sign as you and rotate keys without you touching DNS again. Copy the targets exactly as SendGrid shows them (they include account-specific numbers), then click Verify. SendGrid says verification can take up to 48 hours after the records go in. Automated Security is what keeps the keys current, so leaving it on is the low-maintenance choice; with it off, SendGrid hands you an MX record and three TXT records (SPF, DKIM, DMARC) that you maintain yourself.

Want your tracked links and open-tracking images to come from your domain instead of sendgrid.net too? Answer yes to brand the links for this domain during setup, or set up Link Branding later from the same Sender Authentication page. It is optional, and it adds two more CNAMEs.

Add DMARC

Standard _dmarc TXT record, nothing SendGrid-specific. SendGrid lists one with the CNAMEs; if your domain already has a DMARC record, keep that one, because a domain may carry only one. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

SendGrid mail aligns under relaxed alignment (the default), so this record is all you need on the DMARC side. Build it with our DMARC builder and move past p=none once reports are clean.

The SendGrid gotcha

The classic SendGrid failure is the DNS host appending your domain to the record name. SendGrid even names the usual culprits (GoDaddy, Amazon Route 53, and Namecheap among them): such hosts turn a CNAME for em1234.yourdomain.com into em1234.yourdomain.com.yourdomain.com. Enter only the host label your host expects, and check the saved record does not have your domain doubled on the end.

Two more things that bite. SendGrid's records use underscores (s1._domainkey), and a few DNS hosts refuse underscores in CNAMEs; if yours does, you cannot use Automated Security and need the MX-plus-TXT path instead. And as general DNS advice (not a SendGrid-specific rule): if your DNS host proxies records, such as Cloudflare's orange-cloud, set these CNAMEs to DNS-only so the proxy does not break resolution.

Enable one-click unsubscribe (the 2024 mandate)

Google and Yahoo require bulk senders to support one-click unsubscribe (RFC 8058): the List-Unsubscribe + List-Unsubscribe-Post header pair, covered by your DKIM signature. SendGrid adds the pair automatically for Marketing Campaigns sends, but raw API sends do not get it for free: if your application calls the Mail Send API directly, enable subscription tracking (Settings, then Tracking, then Subscription Tracking, or the subscription_tracking mail setting on the send call) so SendGrid stamps the headers, or set both headers yourself. A footer link alone does not satisfy the requirement.

Confirm it worked

• Verify in SendGrid. The Domain Authentication page should show your domain as verified once all the records resolve.
• Send a test and read the headers. Send through SendGrid, open the message, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it back in plain English.
• Watch the reports. SendGrid should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox labels it as a known sender so you can tell your SendGrid traffic apart from anything else sending as you.