Guides › Providers
SPF, DKIM and DMARC for SendGrid
SPF
With SendGrid's default automated security, you don't add an include. A CNAME such as em1234.yourdomain.com → u1234567.wl123.sendgrid.net handles the return path and SPF. Only if automated security is off do you add include:sendgrid.net to your root SPF.
DKIM
Domain Authentication creates two CNAMEs, s1._domainkey and s2._domainkey, pointing to s1.domainkey.u1234567.wl123.sendgrid.net and similar. Copy them from Settings › Sender Authentication. The checker detects s1 and s2 automatically.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Use the checker to confirm all three records. It detects SendGrid's DKIM selector automatically if it's a standard one.