SPF, DKIM and DMARC for SendGrid

The DNS records SendGrid needs so your mail is authenticated and stays out of spam.

SPF	—	With automated security (the default) SendGrid handles SPF through its `em…` CNAME, which becomes the return-path. You do not need `include:sendgrid.net` at your root domain.
DKIM	CNAME / TXT	Three CNAME records: an `em1234` return-path record plus `s1._domainkey` and `s2._domainkey` pointing into `sendgrid.net`.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

In SendGrid open Settings → Sender Authentication → Authenticate Your Domain and choose your DNS host.
Leave automated security on and enter the domain you send from.
Publish the three CNAME records it generates, then click Verify.
Optional: set up Link Branding so tracked links use your domain instead of sendgrid.net.
Publish DMARC with p=none, then enforce once reports show SendGrid passing.

Turning automated security off means you manage SPF and DKIM TXT records by hand, and they will not rotate keys for you.
Cloudflare users: set the CNAMEs to DNS-only or verification fails.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.