Understanding SendGrid (Twilio) Email Authentication
SendGrid by Twilio uses Automated Security (CNAME-based SPF and DKIM) where a custom subdomain (e.g. em.yourdomain.com) handles Return-Path alignment.
When SendGrid (Twilio) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting SendGrid (Twilio)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for SendGrid
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:sendgrid.net ~all | 3600 | Direct API root SPF authorization. |
| CNAME | s1._domainkey | s1.domainkey.u123456.sendgrid.net | 3600 | Primary DKIM key. |
| CNAME | s2._domainkey | s2.domainkey.u123456.sendgrid.net | 3600 | Secondary DKIM key. |
Step-by-Step Setup Instructions
Log into SendGrid > Settings > Sender Authentication > Domain Authentication.
Enter your root domain. SendGrid generates 3 CNAME records.
Add the two DKIM CNAMEs (s1/s2._domainkey) and the Return-Path CNAME (em.domain.com).
Add "include:sendgrid.net" to your root SPF record.
Verify in SendGrid.
Common SendGrid SPF Configuration Mistakes
× DMARC Alignment Failure
Cause: Sending with From: user@domain.com while Return-Path is shared.
Fix: Complete CNAME Domain Authentication.
Frequently Asked Questions
What is the SPF include for SendGrid?
The SPF mechanism is "include:sendgrid.net".