SendGrid: SPF, DKIM and DMARC setup

This guide shows the DNS records SendGrid needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your SendGrid account where they differ — providers update them from time to time.

1. SPF record for SendGrid

include:sendgrid.net

With SendGrid "domain authentication" (automated security) you add CNAME records and SendGrid handles SPF on its own return-path subdomain, so you usually do not need the include on your root domain. Add include:sendgrid.net only if you turned automated security off.

Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.

2. DKIM for SendGrid

In SendGrid, follow this path and publish the record it shows:

1. SendGrid → Settings → Sender Authentication → Authenticate Your Domain → choose your DNS host → add the CNAME records shown (typically for an em#### subdomain and s1._domainkey / s2._domainkey)
2. Verify.
3. Give DNS a few minutes, then confirm the record with the DKIM Checker.

Once published, verify it with the DKIM Checker (it can also discover common selectors).

3. DMARC

After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.

Where to add the records

• Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
• GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
• Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
• Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
• Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.

Frequently asked questions