DMARC for email delivery services
How do I set up DMARC for SendGrid?
SendGrid domain authentication with automated security uses three CNAME records plus a DMARC TXT record. You do not edit your root SPF record, because SPF is handled on a SendGrid subdomain.
The DNS records for SendGrid
SPF: CNAME on a subdomain SendGrid generates
em<0000> CNAME <u00000000>.<wl000>.sendgrid.netWith automated security off, the same host gets MX mx.sendgrid.net and TXT v=spf1 include:sendgrid.net ~all instead. DKIM then uses m1._domainkey as a TXT record.
DKIM selector: s1 and s2 by default (m1 with automated security off); a custom three-character selector is possible
s1._domainkey CNAME s1.domainkey.<u00000000>.<wl000>.sendgrid.net
s2._domainkey CNAME s2.domainkey.<u00000000>.<wl000>.sendgrid.netThe numbers in the host and target are specific to your account. Copy them from the SendGrid setup screen.
DMARC
_dmarc TXT v=DMARC1; p=none; (keep your existing record if you have one)Values in angle brackets are specific to your account. Copy the real ones from SendGrid rather than from this page.
Alignment caveats
- ✓The Return-Path sits on the em subdomain, so SPF aligns only under relaxed alignment. It will not align if you publish aspf=s.
- ✓SendGrid states that subdomains do not inherit authentication from their parent. Authenticate each domain you send from.
- ✓If you set a custom return path, check that its name does not match an existing record, because SendGrid warns the new record overwrites it.
From p=none to p=reject with SendGrid
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Send a test through SendGrid and confirm the DKIM signature shows d= your domain, not sendgrid.net, before you tighten the policy.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from SendGrid's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how SendGrid really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does SendGrid need?
em<0000> CNAME <u00000000>.<wl000>.sendgrid.net, published as: CNAME on a subdomain SendGrid generates. With automated security off, the same host gets MX mx.sendgrid.net and TXT v=spf1 include:sendgrid.net ~all instead. DKIM then uses m1._domainkey as a TXT record.
What DKIM selector does SendGrid use?
s1 and s2 by default (m1 with automated security off); a custom three-character selector is possible. The numbers in the host and target are specific to your account. Copy them from the SendGrid setup screen.
Will SendGrid mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. The Return-Path sits on the em subdomain, so SPF aligns only under relaxed alignment. It will not align if you publish aspf=s.
How do I reach p=reject with SendGrid?
Start at p=none with a rua address, finish the SendGrid setup, then read your reports. Send a test through SendGrid and confirm the DKIM signature shows d= your domain, not sendgrid.net, before you tighten the policy. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
