SendGrid SPF setup: include record vs domain authentication

The common SendGrid SPF include is:

v=spf1 include:sendgrid.net -all

Twilio SendGrid’s SPF documentation uses include:sendgrid.net as the typical SPF value for authorizing SendGrid.

But there is an important distinction: modern SendGrid setup usually starts with domain authentication. With Automated Security enabled, SendGrid gives you CNAME records so it can manage SPF and DKIM for the authenticated sending subdomain.

Which SendGrid SPF setup do you need?

Use this rule:

• If SendGrid shows DNS records under Sender Authentication, publish those exact records.
• If you are manually maintaining SPF on your root domain, merge include:sendgrid.net into the existing SPF record.
• Do not create a second SPF record just for SendGrid.

For DMARC, domain authentication is usually the better route because it lets SendGrid use your sending domain instead of only sendgrid.net.

Step 1: check your existing SPF record

Open DNS for your domain and find the TXT record that starts with v=spf1.

If your domain already uses Google Workspace, the record might look like:

v=spf1 include:_spf.google.com ~all

Edit that one record and add SendGrid. Our SPF record generator builds the merged value and counts DNS lookups as you go:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

If SendGrid is your only sender, a simple record can be:

v=spf1 include:sendgrid.net -all

Use ~all during transition if you are still discovering senders. Move to -all only when your sender inventory is clean.

Step 2: prefer SendGrid domain authentication

In SendGrid, go to Settings > Sender Authentication and start domain authentication.

SendGrid says authenticated domains replace sendgrid.net with your own sending domain and remove the visible “via” or “sent on behalf of” branding. With Automated Security on, SendGrid provides three CNAME records. The API docs show these as a mail CNAME plus two DKIM CNAME records.

Those records are account-specific. They often look conceptually like:

Purpose	Example host	Example target
Mail / return-path	em.example.com	u123456.wl.sendgrid.net
DKIM 1	s1._domainkey.example.com	s1.domainkey.u123456.wl.sendgrid.net
DKIM 2	s2._domainkey.example.com	s2.domainkey.u123456.wl.sendgrid.net

Do not copy these examples. Use the exact hosts and targets in your SendGrid account.

Step 3: verify in SendGrid and DNS

After publishing records, return to SendGrid and validate the domain authentication.

Then check your domain with DMARCTrust. You want:

• One SPF record.
• Fewer than 10 SPF DNS lookups.
• SendGrid DKIM passing for SendGrid mail.
• DMARC passing through DKIM or aligned SPF.

Common mistakes

Adding include:sendgrid.net as a second SPF record. Merge it into the existing record.

Skipping domain authentication. Root SPF can authorize SendGrid, but DKIM and return-path alignment are usually handled through SendGrid’s sender authentication flow.

Copying example CNAMEs. SendGrid CNAME targets include account-specific values.

Forgetting subusers. SendGrid subusers can have their own authenticated domains. Verify the account or subuser that actually sends the mail.

What about DKIM?

For SendGrid, DKIM is part of domain authentication. Read the companion guide: SendGrid DKIM setup.

SPF helps receiving servers authorize SendGrid infrastructure, but DKIM is often what makes DMARC pass cleanly for marketing and transactional mail.

FAQ

What is the SendGrid SPF record?

The common SPF include is include:sendgrid.net, used inside a single SPF TXT record.

Should I use SendGrid Automated Security?

Usually yes. Automated Security lets SendGrid provide CNAME records and manage SPF/DKIM details for the authenticated domain.

Does SendGrid SPF make DMARC pass?

Not always. DMARC requires SPF or DKIM to pass with alignment. Configure SendGrid domain authentication and DKIM, then verify real messages.