SendGridSPF, DKIM & DMARC Setup
SendGrid's 'Domain Authentication' replaces manual SPF and DKIM records with three CNAMEs that delegate to sendgrid.net — SPF and DKIM then pass with your domain automatically.
Already set up? Check what your domain publishes right now — SPF, DKIM (s1, s2), DMARC, MX, BIMI, and MTA-STS in one scan.
Run a free domain check →1. SPF record
Domain authentication creates an em####.yourdomain.com CNAME that covers the envelope domain. Only add include:sendgrid.net to a manual SPF record in legacy setups without domain authentication.
TXT record
Handled via CNAME delegation (no manual v=spf1 record needed for SendGrid)2. DKIM (selectors: s1, s2)
Settings → Sender Authentication → Authenticate Your Domain. SendGrid generates three CNAMEs: em####.yourdomain.com plus s1._domainkey and s2._domainkey → *.domainkey.u#######.wl###.sendgrid.net. Publish all three and click Verify.
3. MX records
No MX changes — SendGrid is sending-only. Your mailbox provider keeps its MX records.
4. DMARC record
With domain authentication verified, both SPF and DKIM align with your domain, so DMARC passes. Publish DMARC on the root domain starting at p=none.
TXT record at _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comSendGrid authentication FAQ
Should I use automated security or manual DNS?
Automated security (the default, CNAME-based) — it lets SendGrid rotate DKIM keys without you touching DNS again. Manual TXT setup exists for DNS providers that block CNAME flattening edge cases, but it freezes key rotation on you.
Do I still need a link-branding CNAME?
Link branding (url####.yourdomain.com) is separate from authentication — it rewrites click-tracking links to your domain. Not required for DMARC, but it removes the 'via sendgrid.net' look on tracked links.
Official documentation: SendGrid email authentication docs ↗
Verify your setup
DNS Email Diagnostics
SPF, DKIM, DMARC, MX, BIMI & MTA-STS in one check
MX Record Lookup
See exactly which mail servers your domain publishes
BIMI Validator
Show your logo in Gmail & Yahoo once DMARC is enforced
Deliverability Monitoring
Daily checks + email alerts when a record changes or breaks