Guides · Updated 2026-10-11

SendGrid domain authentication for DMARC

SendGrid's Domain Authentication makes SendGrid sign mail with your domain and use a Return-Path subdomain you control, so both DKIM and SPF can align.

Steps

1. In SendGrid, open Settings > Sender Authentication > Authenticate Your Domain and select your DNS host.
2. With automated security on (the default), SendGrid gives you three CNAME records: a Return-Path subdomain (like em1234) and two DKIM selectors (s1._domainkey and s2._domainkey).
3. Add them exactly as shown, then click Verify.

Because SendGrid manages the targets, it can rotate keys and update SPF without you editing DNS again.

Sources

• Twilio SendGrid: How to set up domain authentication

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.