How to set up SPF, DKIM & DMARC for SendGrid

SendGrid's "Domain Authentication" replaces the old shared-domain setup with three CNAME records unique to your account. They cover DKIM and the return-path at once — with them in place you don't add any SPF include for SendGrid.

The three CNAMEs

All three values embed your SendGrid account ID, so copy them from the wizard. The em CNAME sets your return-path (which makes SPF align); the two s._domainkey CNAMEs are DKIM.

Type	`CNAME`
Host / Name	`em1234`
Value / Content	`u1234567.wl123.sendgrid.net` Example only — all three host/target pairs come from Settings → Sender Authentication → Authenticate Your Domain.

Type	`CNAME`
Host / Name	`s1._domainkey`
Value / Content	`s1.domainkey.u1234567.wl123.sendgrid.net` Example only — copy the exact target from the same wizard.

Type	`CNAME`
Host / Name	`s2._domainkey`
Value / Content	`s2.domainkey.u1234567.wl123.sendgrid.net` Example only — copy the exact target from the same wizard.

SendGrid → Settings → Sender Authentication → Authenticate Your Domain.
Pick your DNS host, enter your domain, and publish the three CNAMEs it generates.
Click Verify. Done — do not also add include:sendgrid.net to your SPF record; the CNAME setup already handles it.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers SendGrid and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: Domain authentication gives you aligned DKIM and an aligned custom return-path (SPF) in one step. Mail sent before verification completes authenticates as sendgrid.net and won't align.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from SendGrid to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is SendGrid's official docs.