SendGrid: DKIM and SPF setup

Before you start

Twilio SendGrid calls this domain authentication. You need access to the DNS settings of example.com, or someone who has it. SendGrid's page does not name a SendGrid role for the setup.

SendGrid says an EU-pinned domain or link branding needs the Email API Pro plan or higher, or the Marketing Campaigns Advanced plan or higher. SendGrid says regional email users must pin their domain to the EU region.

Turn on DKIM

Domain authentication sets up DKIM and SPF together.

1. In the SendGrid console, select Settings > Sender Authentication.
2. In the Domain Authentication section, click Get Started.
3. Select your DNS host from Which Domain Name Server (DNS) host do you use? Choose whether to brand links too, and click Next.
4. In Domain You Send From, type example.com. SendGrid says subdomains do not inherit authentication from their parent domain, so authenticate each domain you send from.
5. Open Advanced Settings. Leave Use automated security checked unless your DNS host does not accept underscores in CNAME records. Check Use custom return path to name the bounce subdomain yourself (see Use your own bounce domain).
6. Click Next. On Install DNS Records, add the records shown at your DNS host, then click Verify.

With automated security on, SendGrid's example records are:

The numbers differ for your account. Copy them from SendGrid. With automated security off, SendGrid shows an MX record and TXT records instead, and the DKIM TXT record uses the selector m1. SendGrid's default selector is s, as in s1 and s2. If another service already uses it, check Use a custom DKIM selector and enter three letters or numbers.

About the DMARC record. SendGrid's list includes a DMARC record. If example.com already has a DMARC record, it sends reports to your reporting address. A domain may have only one. Do not add SendGrid's. SendGrid says a DMARC failure on this page does not stop authentication from succeeding.

Sign with your own domain

SendGrid says that when it cannot match your mail to an authenticated domain, it uses sendgrid.net. DKIM then passes for sendgrid.net but does not align with example.com. SendGrid picks the authenticated domain that matches the From address, then your default authenticated domain. Authenticate example.com as in Turn on DKIM, and send with a From address at example.com.

Use your own bounce domain

Domain authentication already moves bounces to example.com. SendGrid creates a return path subdomain of example.com with four random characters, the em1234 record above. To choose the name yourself, check Use custom return path under Advanced Settings and type the subdomain. It appears on Install DNS Records as a CNAME pointing to sendgrid.net.

SendGrid warns that a CNAME with the same name as an existing record overwrites it. Check the existing records of example.com before adding one.

SPF

With automated security on, the return path CNAME handles SPF. The records SendGrid lists for it include no change to the SPF record of example.com. With automated security off, SendGrid shows an SPF TXT record, v=spf1 include:sendgrid.net ~all, for the return path subdomain, not for example.com itself. SendGrid says to update it whenever your SendGrid setup changes, for example when you add an IP address.

Check the DKIM key

SendGrid's troubleshooting page covers these problems:

1. Records do not validate. Give them up to 48 hours. Check that your DNS host did not add example.com a second time, as in em1234.example.com.example.com.
2. "Expected TXT record at m1._domainkey…" With automated security off, the DKIM TXT record was split into several quoted parts. Join the key back into one quoted string.
3. Duplicate records. Remove any other record with the same name as a SendGrid CNAME.

Check it worked

1. After you click Verify, SendGrid shows the records it verified. If only some of them verify, wait, then check the rest for typos.
2. To check a record yourself, SendGrid suggests a DNS lookup. A CNAME lookup of s1._domainkey.example.com returns the value SendGrid showed you.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for SendGrid. The DKIM table on Mailmoni's DNS tab lists SendGrid's selectors, such as s1, once a report includes them.

SendGrid's pages: Configure domain authentication, Troubleshooting sender authentication and Enforce authentication with a DMARC policy.