DKIM fix
How to Set Up DKIM for SendGrid
Use this to turn on SendGrid DKIM: add their s1/s2 CNAMEs so mail signs with your domain and DMARC alignment can pass.
Why SendGrid gives you two DKIM hostnames
They rotate selectors. One CNAME means random verification fails — you need both s1 and s2 live.
What SendGrid shows in the dashboard
s1._domainkey.yourdomain.com → CNAME → s1.domainkey.u[ID].wl.sendgrid.net
s2._domainkey.yourdomain.com → CNAME → s2.domainkey.u[ID].wl.sendgrid.net
Copy exact values from SendGrid — your [ID] is account-specific. See also DKIM in the glossary.
Authenticate, paste, verify
Step 1 SendGrid → Settings → Sender Authentication → Authenticate Domain
Step 2 Enter your domain
Step 3 Copy s1 and s2 CNAME records from SendGrid
Step 4 Add to your DNS provider
Step 5 Click Verify in SendGrid
Step 6 Run DNS Preflight to confirm DKIM pass
Run DNS Preflight to resolve s1/s2 and confirm DKIM DNS
Open DNS Preflight →FAQ
What are SendGrid's DKIM selectors?
s1 and s2 — that’s the pair they rotate for signing.
Do I need both s1 and s2 CNAMEs?
Yes — one leg missing and half your mail fails DKIM.
How do I find my SendGrid account ID for the CNAME values?
Open Sender Authentication — targets include your id in the hostname.
Will DKIM signing start immediately after adding CNAMEs?
No — DNS has to propagate first. Often hours; budget two days.
Does SendGrid DKIM setup also fix DMARC?
Usually yes — aligned DKIM is enough for DMARC on their mail. Details: DMARC for SendGrid.