How to authenticate email with SendGrid (SPF, DKIM, DMARC)

The short version: run SendGrid’s Domain Authentication wizard, publish the CNAME records it generates (DKIM plus an aligned Return-Path for SPF), add link branding, then publish a starter DMARC record. Together these prove to Gmail, Yahoo and Outlook that your SendGrid mail is genuinely yours, and DMARC tells inboxes what to do on failure while reporting back to you. It’s free, and verifiable in a minute once DNS propagates.

What each piece does here (the non-technical version)

SendGrid is a shared platform, so the goal is to make its mail authenticate as your domain rather than SendGrid’s. Domain Authentication (formerly “whitelabel”) sets up two things at once: DKIM, a cryptographic seal signed as your domain, and an aligned Return-Path (a custom bounce subdomain) that makes SPF align to your From address too. Both are delivered as automated CNAMEs that point back into SendGrid, so SendGrid can rotate keys without you touching DNS again. Link branding rewrites tracked click and open URLs to a subdomain of yours instead of sendgrid.net, which both looks trustworthy and avoids a separate domain in the message. DMARC is the policy that requires at least one aligned pass. For the mechanics, see the complete SPF, DKIM & DMARC guide.

Step 1 — Run Domain Authentication

In the SendGrid dashboard:

1. Go to Settings → Sender Authentication → Authenticate Your Domain.
2. Pick your DNS host from the list (this only tailors the instructions) and enter your sending domain, e.g. yourdomain.com.
3. Leave branded links on if you want link branding included, and choose whether to use a custom Return-Path subdomain (recommended — it’s what gives you SPF alignment).
4. SendGrid generates a set of CNAME records. Publish them all at your DNS host.

The records SendGrid produces follow this pattern — the host prefixes and targets are unique to your account, so copy them exactly from the wizard:

Host/Name:  em1234                     (custom Return-Path / mail subdomain) Type:       CNAME Value:      u1234567.wl.sendgrid.net Host/Name:  s1._domainkey             (DKIM key 1) Type:       CNAME Value:      s1.domainkey.u1234567.wl.sendgrid.net Host/Name:  s2._domainkey             (DKIM key 2) Type:       CNAME Value:      s2.domainkey.u1234567.wl.sendgrid.net   (all from your SendGrid wizard)

Once they resolve, return to the wizard and click Verify. SendGrid checks the records and marks the domain authenticated. Because these are CNAMEs pointing at SendGrid, SPF and DKIM now align to your domain automatically — the em1234 subdomain becomes your envelope/Return-Path so SPF aligns, and s1/s2 sign as your domain so DKIM aligns. SendGrid’s reference: Set up domain authentication. Verify the DKIM selector with the DKIM Checker and SPF with the SPF Checker.

Step 2 — Add link branding (optional but recommended)

If you didn’t include it in Step 1, add it under Settings → Sender Authentication → Link Branding. SendGrid generates two more CNAMEs that route tracked links through a subdomain of yours instead of sendgrid.net. This doesn’t affect DMARC, but it removes a foreign domain from your clicks and improves how filters and recipients perceive the message.

Step 3 — Publish a starter DMARC record

Add DMARC at your root domain in monitor-only mode:

Host/Name:  _dmarc Type:       TXT Value:      v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

The p=none policy affects no delivery — it just turns on the daily aggregate reports to the rua mailbox, revealing every service sending as your domain and whether each passes. Build it with the DMARC Generator, validate with the DMARC Checker, and route rua to a parser through DMARC monitoring since the raw XML is unreadable by hand.

Step 4 — Verify everything passes

After DNS propagates, confirm all three at once with the Email Health Check, or individually with the SPF Checker, DKIM Checker and DMARC Checker. The definitive test: send a message through SendGrid to a personal Gmail account, open Show original, and confirm SPF, DKIM and DMARC all read PASS with your own domain in the DKIM d= field (not sendgrid.net).

Step 5 — Move DMARC toward enforcement

After two to four weeks of clean reports where every legitimate sender passes, ramp the policy so spoofers are stopped: p=none → p=quarantine (optionally pct=25 first) → p=reject, checking reports at each step. This is the policy the major providers reward and the prerequisite for a BIMI logo. The full staged rollout is in the complete guide.

Common mistakes

• Not clicking Verify. Publishing the CNAMEs isn’t enough — SendGrid only marks the domain authenticated (and starts signing as your domain) after the wizard’s verification succeeds.
• Skipping the custom Return-Path. Without an aligned Return-Path subdomain, SPF passes for SendGrid but doesn’t align, so DMARC relies solely on DKIM. See why SPF passes but DMARC fails.
• Proxying the CNAMEs. On Cloudflare these must be DNS-only (grey cloud); a proxied CNAME breaks DKIM and Return-Path resolution.
• Adding an include:sendgrid.net SPF record and thinking that’s enough. Domain Authentication’s aligned CNAMEs are what make DMARC pass; a bare root SPF include authorises SendGrid but doesn’t give you alignment.
• Only publishing one DKIM CNAME. SendGrid provides two (s1 and s2); publish both.

Where the records go

Every record here lives at your domain’s DNS host, not inside SendGrid. On Cloudflare, follow how to add DNS records in Cloudflare and keep the CNAMEs DNS-only. The always-current exact host prefixes and targets are the ones SendGrid shows in the Domain Authentication wizard for your account — treat those as the source of truth.