SendGrid DKIM setup: authenticate your sending domain
Set up SendGrid DKIM with domain authentication, publish the two DKIM CNAME records, validate them in SendGrid, and verify DMARC alignment.
SendGrid DKIM is configured through domain authentication.
When you authenticate a domain, Twilio SendGrid generates DNS records for your account. With Automated Security enabled, SendGrid provides three CNAME records: one mail CNAME and two DKIM CNAME records. The SendGrid domain authentication API docs show DKIM records named dkim1 and dkim2.
Do not use generic DKIM values from the internet. SendGrid records are account-specific.
Before you start
You need:
- Admin access to SendGrid.
- DNS access for the sending domain.
- A From address using a domain you own.
- A decision about subdomain, for example
em.example.comormail.example.com.
If you send from multiple brands or subusers, authenticate the right domain in the right SendGrid account or subuser.
Step 1: start domain authentication
In SendGrid, open Settings > Sender Authentication > Domain Authentication.
Choose the domain you send from. SendGrid may ask for a subdomain. Use a subdomain that is not already used for another service. For example, if mail.example.com already points somewhere else, do not reuse it for SendGrid.
Leave Automated Security enabled unless you have a specific reason not to. SendGrid’s docs say Automated Security uses CNAME records, while disabling it changes the DNS record set.
Step 2: copy the DKIM CNAME records
SendGrid will show DNS records to publish. The DKIM records commonly use selectors like s1 and s2.
The records may look conceptually like:
| Type | Host | Points to |
|---|---|---|
| CNAME | s1._domainkey.example.com |
s1.domainkey.u123456.wl.sendgrid.net |
| CNAME | s2._domainkey.example.com |
s2.domainkey.u123456.wl.sendgrid.net |
These are examples only. Copy the exact host and value fields from SendGrid.
Some DNS providers want the full hostname. Others want only s1._domainkey or s2._domainkey. Check the preview before saving so you do not create s1._domainkey.example.com.example.com.
Step 3: publish the mail CNAME too
Do not publish only the DKIM records. With Automated Security, the mail CNAME is part of the authenticated-domain setup and lets SendGrid handle the return-path domain.
That matters for SPF and DMARC. A custom return-path can make SPF alignment possible for SendGrid mail, while DKIM gives you the stronger and more reliable aligned authentication path.
Step 4: validate in SendGrid
Return to SendGrid and click the validation action for the authenticated domain.
If validation fails:
- Confirm the records are in the authoritative DNS provider.
- Check whether your DNS provider appended the domain twice.
- Wait for propagation.
- Verify no existing CNAME was overwritten.
SendGrid troubleshooting docs note that if no valid authenticated domain matches the From address, SendGrid falls back to sendgrid.net.
Step 5: verify DMARC alignment
Send a real test message through the same SendGrid sender or API key you use in production.
Then inspect the headers. DKIM should pass and the d= domain should align with your From domain or subdomain.
Use DMARCTrust’s domain checker to check SPF, DMARC, and DNS syntax. After DMARC reports arrive, confirm SendGrid appears as an authorized source in your DMARCTrust dashboard.
Common mistakes
Authenticating one domain and sending from another. SendGrid matches authenticated domains to the From address. If they do not match, authentication may fall back.
Publishing only one DKIM record. Publish both selectors so SendGrid can rotate keys.
Overwriting an existing CNAME. Do not reuse a subdomain that another service already uses.
Relying only on SPF. SPF can be useful, but DKIM is usually the cleaner path to DMARC alignment for SendGrid.
FAQ
What are the SendGrid DKIM records?
They are account-specific CNAME records generated during domain authentication, commonly with selectors like s1 and s2.
Should I copy SendGrid DKIM records from an example?
No. Use the records shown in your SendGrid account.
Why does my message still show sendgrid.net?
SendGrid may not be matching the From address to a valid authenticated domain. Check the sender, subuser, and domain authentication status.
