Set up DMARC with SendGrid

SendGrid differs from other sending platforms on one point that changes everything for DMARC: its domain authentication has you delegate a subdomain, and that subdomain is what makes SPF alignment possible.

The three CNAMEs

Domain authentication, with automated security turned on, gives you three records:

em1234…             →  a sending subdomain delegated to SendGrid
s1._domainkey       CNAME  s1.domainkey.uXXXX.wlYYY.sendgrid.net.
s2._domainkey       CNAME  s2.domainkey.uXXXX.wlYYY.sendgrid.net.

The first creates a subdomain such as em1234.yourdomain.com, delegated to SendGrid. The other two are the DKIM selectors, s1 and s2 by default; SendGrid rotates the keys between them on its own, so you never renew them by hand.

Why that delegation matters

On most platforms the envelope address stays the provider’s: SPF passes without aligning, and only DKIM saves DMARC compliance. Here the envelope address becomes em1234.yourdomain.com — a subdomain of yours. Under relaxed alignment, the default mode, a subdomain matches the parent domain: SPF and DKIM both align.

That is comfortable, and it is no reason to skip DKIM: SPF breaks on forwarding, DKIM does not.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Only tighten once every sender is identified. The progression, step by step.

Common mistakes with SendGrid

• A zone editor that refuses underscores in CNAME records. Automated security then becomes impossible and you have to switch to manual mode — SendGrid documents this, and it catches people out at the moment of pasting.
• Adding a SendGrid include to your SPF. Pointless with automated security: the delegated subdomain already carries its own policy, and you would burn a DNS lookup for nothing.
• Confusing domain authentication with link branding. Two separate settings; the second plays no part in DMARC.
• Sending from an unauthenticated domain while another one is authenticated: alignment is judged on the From: domain, not on the SendGrid account.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.