SendGrid sends transactional and marketing mail through its API and SMTP relay. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.
What to add. The records from SendGrid's domain authentication screen. With automated security on, the default, those records are CNAMEs and you add nothing to your root SPF record.
What signs your mail.
DKIM under s1._domainkey and s2._domainkey. With
automated security off, the key sits under m1._domainkey.
SendGrid sends from whatever From address you give it, so mail goes out on a domain you never authenticated while the one you did sits unused in the account.
The SPF record
Add this only if you are sending without SendGrid's domain authentication. With domain
authentication set up the way SendGrid recommends, the envelope sender moves to a subdomain
of yours, something like em1234.example.com, with a CNAME pointing at
SendGrid. Receivers then check the SPF record SendGrid publishes behind that subdomain, so
your root record and its ten-lookup budget stay untouched.
That is the better setup, and it is why a lot of correctly configured SendGrid domains have
no sendgrid.net in their SPF record at all.
If you turn automated security off, you publish that subdomain's records yourself instead
of a CNAME. Its SPF record then carries include:sendgrid.net.
The include is:
Count your lookups after any change, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count. It also shows whether SendGrid needs the include on the domain you check.
DKIM
SendGrid generates three CNAMEs for domain authentication. The account-specific parts (the user number
and the wl host) come from your account, so copy them from the SendGrid screen:
Leave automated security on. SendGrid then rotates the keys behind the CNAMEs and you
never touch DNS again. With automated security off, SendGrid shows TXT and MX records in
place of the CNAMEs. The em1234 subdomain gets an MX record and an SPF
record. The DKIM key goes in a TXT record under m1._domainkey, and you
rotate that key yourself.
Return path and SPF alignment
The em1234 CNAME is your return-path host. Because it is a subdomain of
example.com, SPF aligns under relaxed matching, which is the default. Skip it
and SPF authenticates sendgrid.net, which aligns with nothing of yours.
DMARC alignment with SendGrid
DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.
- Subusers get their own authenticated domains. A subuser that sends under a different domain needs that domain authenticated as well.
- Link branding is a separate CNAME and a separate setting. It doesn't affect DMARC.
Unbranded links that point at
sendgrid.netdo hurt your clickthrough. - If you also keep
include:sendgrid.netin your root record out of caution, it costs a lookup you may need later. Take it out once domain authentication is verified.
The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.
Verification
Substitute your domain, and run these after the TTL on anything you replaced has expired:
Then send one message through SendGrid to a Gmail address you control, open Show original,
and look for dkim=pass with your domain in header.i. A test
message shows what a receiver does with your mail. A DNS lookup only shows what you
published.
Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.
I checked the values here against SendGrid's own documentation, at SendGrid domain authentication docs. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.
A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.
Does your domain need SendGrid's SPF include?
We look for include:sendgrid.net in your SPF record, say whether SendGrid
needs it there, and count your lookups.
Free · No signup · The result names what to change
Questions
Do I need include:sendgrid.net in my SPF record?
Your root record doesn't need include:sendgrid.net once SendGrid's domain authentication is done. The return-path then sits on a subdomain of yours, such as em1234.example.com. With automated security on, that subdomain is a CNAME to SendGrid, and SendGrid publishes the SPF record behind it. With automated security off, you publish that subdomain's SPF record yourself, with include:sendgrid.net in it. Add include:sendgrid.net to your root record only if you send without domain authentication.
Keep reading
Adding this to a domain that already sends? Our SPF record generator merges the include into the record you publish today rather than replacing it, the SPF checker resolves every include and counts the lookups, and the DKIM checker confirms the selector answers.