SPF, DKIM and DMARC · Checked 8 November 2026

SendGrid SPF, DKIM and DMARC records

The records that let mail sent through SendGrid pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

em1234.example.com.  IN  CNAME  u00000000.wl000.sendgrid.net.
  • With automated security on (the default), SendGrid does not ask for an SPF TXT record. It gives you a CNAME for a return-path subdomain, such as em1234, and SPF is handled behind it. The example above shows the pattern; your numbers come from SendGrid.
  • Enter only the host part (em1234), not the full name. Some DNS providers add your domain automatically, which produces em1234.example.com.example.com.
  • If automated security is off, SendGrid gives you an MX record for that host and TXT records for SPF, DKIM and DMARC, and you maintain them yourself.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • Automated security creates four records: CNAMEs for the return path, s1._domainkey and s2._domainkey, plus a DMARC TXT record at _dmarc with v=DMARC1; p=none;.
  • The DKIM targets look like s1.domainkey.u00000000.wl000.sendgrid.net. Copy them from SendGrid; they differ per account.
  • A custom DKIM selector must be three letters or numbers, such as org or 001, so it does not clash with the s selectors.
  • Turn automated security off if your DNS provider does not accept underscores in CNAME records.
s1._domainkey.example.com.  IN  CNAME  s1.domainkey.u00000000.wl000.sendgrid.net.

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • The domain appended twice to the host (em1234.example.com.example.com).
  • An existing CNAME at the return-path or link-branding host being overwritten.
  • A DNS host that rejects underscores in CNAME names.
  • Treating the DMARC record SendGrid offers as finished. p=none only collects data; you still need to read the reports and tighten it.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What DNS records does SendGrid domain authentication create?

With automated security on, three CNAME records (a return-path host plus s1._domainkey and s2._domainkey) and a DMARC TXT record at _dmarc. With it off, an MX record and three TXT records instead.

Why does SendGrid use CNAME records for SPF and DKIM?

So SendGrid can update the underlying records, including key rotation, without you changing DNS.

Why does my SendGrid host name look doubled?

Your DNS provider appends your domain to the host field. Enter only the first part of the name, such as em1234 or s1._domainkey.

Is SendGrid's DMARC record enough?

It is a start. It uses p=none, which reports but does not block. Add a rua address, read the reports, then tighten the policy.