Email provider

DKIM setup for SendGrid

DKIM proves message integrity. SendGrid gives you a selector and key or CNAME targets — publish them exactly.

Common mistake: Skipping branded link / CNAME authentication — DKIM won’t align to your domain until you complete the CNAME steps SendGrid shows.

Step by step

Step 1 SendGrid Dashboard → Settings → Sender Authentication.

Step 2 Copy the exact hostnames and values SendGrid shows — do not invent selectors. Typical pattern:

CNAME records s1.domainkey.uXXXXX.wl.sendgrid.net and s2.domainkey... — exact targets shown in Sender Authentication after you add the domain.

Step 3 Add TXT or CNAME at the DNS provider that hosts your domain. Truncated keys fail verification.

Step 4 Query the record from an authoritative resolver or use propagation checker.

Step 5 Google Workspace / some hosts require clicking “enable” after DNS is green.

Step 6 Send a test message; check DKIM-Signature and d=. Run DNS Preflight. Align with DMARC: /fix/dmarc/.

DNS Preflight — verify SPF, DKIM, DMARC in one pass.

DMARC alignment — fixes when reports show failures.

In the provider’s domain authentication / sender settings — copy live values.

Use what the provider specifies — both are common.

Wrong selector, truncated key, or signing not enabled after publish.

You need SPF + DKIM alignment for your From domain — DKIM is often the easier path for ESPs.

DNS Preflight for the published key; send test mail for header verification.