DKIM record for Twilio SendGrid

The DNS records

SendGrid generates the numbers for your account. The values below use the placeholders from SendGrid's own docs.

DKIM selector s1 (automated security on)

Type: CNAME · Host: s1._domainkey Copy

s1.domainkey.u00000000.wl000.sendgrid.net

DKIM selector s2 (automated security on)

Type: CNAME · Host: s2._domainkey Copy

s2.domainkey.u00000000.wl000.sendgrid.net

Return path (automated security on)

Type: CNAME · Host: em0000 Copy

u00000000.wl000.sendgrid.net

This record handles bounces and SPF; it isn't part of DKIM, but SendGrid checks it in the same step.

DKIM key with automated security off

Type: TXT · Host: m1._domainkey Copy

k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…

In this mode SendGrid also gives an MX and an SPF TXT record on em<number>, and you update the TXT records yourself when your setup changes.

Set it up and turn on signing

1. In SendGrid, go to Settings > Sender Authentication and click Get Started under Domain Authentication.
2. Choose your DNS host, say whether to brand links, and enter the domain you send from under Domain You Send From.
3. Under Advanced Settings, leave Use automated security on unless you need TXT records. Tick Use a custom DKIM selector if another service at your domain already uses the s1/s2 names.
4. Click Next to see the Install DNS Records page, add the records at your DNS host, then click Verify. SendGrid says DNS changes can take up to 48 hours.
5. For a GoDaddy domain with automated security on and link branding off, SendGrid can add the records for you through Domain Connect.

DMARC alignment

Until a domain is authenticated, SendGrid signs with sendgrid.net and recipients may see "via sendgrid.net". After it is, signatures use your domain. SendGrid picks the domain that matches the From address first, then your default authenticated domain, and only then sendgrid.net, so authenticate every From domain you use. The return path sits on an em subdomain of yours, which can give SPF relaxed alignment as well.

Key length and rotation

With automated security, Twilio says it uses the s1 and s2 selectors interchangeably and rotates them when necessary, with only one active at a time. It doesn't publish the key length or a schedule. With automated security off, the m1._domainkey TXT key is in your zone, so any change means editing the record yourself.

Common mistakes

• Your domain doubled. SendGrid notes that GoDaddy, Route 53 and Namecheap append the domain, so enter s1._domainkey, not s1._domainkey.example.com.
• Selector clash. If another sender already publishes s1._domainkey, use a custom DKIM selector (three letters or numbers) instead of overwriting it.
• Turning off automated security to avoid underscores. It swaps the CNAMEs for MX and TXT records, but SendGrid notes a DKIM record always contains an underscore (m1._domainkey), so a host that rejects underscores still can't publish it.
• Leftover records at the same name. An old MX or TXT at the em host conflicts with the CNAME.