emailsecops
Menu
Guides

SendGrid SPF, DKIM and DMARC setup

Authenticate your domain in SendGrid. With automated security (the default) you publish three CNAMEs: em{nnnn} for the return path plus s1 and s2 for DKIM. DKIM aligns with your From domain, and SPF aligns through the em{nnnn} subdomain.

Transactional email API · reviewed October 13, 2026 against SendGrid's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your SendGrid account: copy it from SendGrid's setup screen, which shows the exact record.

ForTypeHostValue
Return pathAutomated security on (default) CNAME em{nnnn}.{domain} u{user-id}.wl{nnn}.sendgrid.netSendGrid generates the em{nnnn} label and hosts SPF and the bounce MX behind it.
DKIMAutomated security on (default) CNAME s1._domainkey.{domain} s1.domainkey.u{user-id}.wl{nnn}.sendgrid.netCopy the exact values from SendGrid's Install DNS Records page.
DKIMAutomated security on (default) CNAME s2._domainkey.{domain} s2.domainkey.u{user-id}.wl{nnn}.sendgrid.netSecond key; SendGrid switches between s1 and s2 when it rotates, with one active at a time.
Bounces (MAIL FROM)Automated security off MX em{nnnn}.{domain} mx.sendgrid.netBounce MX on the return-path subdomain, published next to the SPF record below.
SPFAutomated security off TXT em{nnnn}.{domain} v=spf1 include:sendgrid.net ~allOn the return-path subdomain, not the root; update it yourself when you add IPs.
DKIMAutomated security off TXT m1._domainkey.{domain} k=rsa; t=s; p={public-key}Keep the key in one string; a split value fails validation.
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}SendGrid's setup page lists v=DMARC1; p=none; as a fourth record, but authentication succeeds without it.

SPF

SendGrid's domain authentication puts SPF on the return-path subdomain em{nnnn}.{domain}, not on your root domain. With automated security SendGrid publishes it behind the em{nnnn} CNAME; with it off, you publish v=spf1 include:sendgrid.net ~all there yourself. It aligns with your From domain under relaxed alignment; with aspf=s, only a custom return path used with a From address on that same subdomain aligns.

DKIM

With automated security, s1._domainkey and s2._domainkey are CNAMEs to keys SendGrid manages and rotates, one active at a time; with it off, you publish the key yourself as a TXT record at m1._domainkey and update it whenever you change the sending domain. Authentications created after May 2021 use 2048-bit keys; older ones may still have 1024-bit keys until you re-authenticate with a custom selector.

DMARC alignment

DKIM aligns through the s1/s2 (or m1) key on your domain, and SPF aligns under relaxed alignment because the Return-Path is em{nnnn}.{domain}. With aspf=s only DKIM aligns, unless the From address uses a custom return-path subdomain.

Common mistakes

  • Automated security needs underscores in CNAME names; if your DNS host rejects them, turn automated security off.
  • GoDaddy, Route 53, Namecheap and others append your domain to the name, so enter only the host part (em123) or you get em123.example.com.example.com.
  • Subdomains don't inherit authentication from their parent domain; authenticate each domain you send From.
  • Authenticating the same domain in several accounts or subusers needs a custom DKIM selector, published as {sel}._domainkey and {sel}2._domainkey.
  • Authentications from before May 2021 may still use 1024-bit keys; upgrading means a new authentication with a custom selector, then deleting the old one.
  • A custom return path can only be chosen when you create the authentication.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises SendGrid

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: sendgrid.net
  • Default DKIM selectors: s1, s2, m1
  • DKIM keys delegated (CNAME) to *.sendgrid.net

Questions

What SPF record does SendGrid need?+
SendGrid's domain authentication puts SPF on the return-path subdomain em{nnnn}.{domain}, not on your root domain. With automated security SendGrid publishes it behind the em{nnnn} CNAME; with it off, you publish v=spf1 include:sendgrid.net ~all there yourself. It aligns with your From domain under relaxed alignment; with aspf=s, only a custom return path used with a From address on that same subdomain aligns.
What are the DKIM records for SendGrid?+
With automated security, s1._domainkey and s2._domainkey are CNAMEs to keys SendGrid manages and rotates, one active at a time; with it off, you publish the key yourself as a TXT record at m1._domainkey and update it whenever you change the sending domain. Authentications created after May 2021 use 2048-bit keys; older ones may still have 1024-bit keys until you re-authenticate with a custom selector.
Does SendGrid mail pass DMARC?+
DKIM aligns through the s1/s2 (or m1) key on your domain, and SPF aligns under relaxed alignment because the Return-Path is em{nnnn}.{domain}. With aspf=s only DKIM aligns, unless the From address uses a custom return-path subdomain.
Do I need a separate DMARC record for SendGrid?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources