# DKIM record for Twilio SendGrid URL: https://iblockspam.com/dkim/sendgrid Last updated: 2026-10-09 Record type: CNAME or TXT Selectors: s1, s2 Key managed by: Provider (CNAME delegation) SendGrid authenticates your domain with two DKIM CNAME records, `s1._domainkey` and `s2._domainkey`, pointing to `s1.domainkey.u.wl.sendgrid.net` and its `s2` twin, plus an `em` CNAME for the return path. That is the default, "automated security", where Twilio holds and rotates the keys. With it off, you publish a TXT key at `m1._domainkey` instead. ## DNS records - DKIM selector s1 (automated security on) (CNAME, host s1._domainkey): `s1.domainkey.u00000000.wl000.sendgrid.net` - DKIM selector s2 (automated security on) (CNAME, host s2._domainkey): `s2.domainkey.u00000000.wl000.sendgrid.net` - Return path (automated security on) (CNAME, host em0000): `u00000000.wl000.sendgrid.net` This record handles bounces and SPF; it isn't part of DKIM, but SendGrid checks it in the same step. - DKIM key with automated security off (TXT, host m1._domainkey): `k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…` In this mode SendGrid also gives an MX and an SPF TXT record on `em`, and you update the TXT records yourself when your setup changes. ## Set it up and turn on signing - In SendGrid, go to **Settings > Sender Authentication** and click **Get Started** under Domain Authentication. - Choose your DNS host, say whether to brand links, and enter the domain you send from under **Domain You Send From**. - Under **Advanced Settings**, leave **Use automated security** on unless you need TXT records. Tick **Use a custom DKIM selector** if another service at your domain already uses the `s1`/`s2` names. - Click **Next** to see the **Install DNS Records** page, add the records at your DNS host, then click **Verify**. SendGrid says DNS changes can take up to 48 hours. - For a GoDaddy domain with automated security on and link branding off, SendGrid can add the records for you through Domain Connect. ## DMARC alignment Until a domain is authenticated, SendGrid signs with `sendgrid.net` and recipients may see \"via sendgrid.net\". After it is, signatures use your domain. SendGrid picks the domain that matches the From address first, then your default authenticated domain, and only then `sendgrid.net`, so authenticate every From domain you use. The return path sits on an `em` subdomain of yours, which can give SPF relaxed alignment as well. ## Key length and rotation With automated security, Twilio says it uses the `s1` and `s2` selectors interchangeably and rotates them when necessary, with only one active at a time. It doesn't publish the key length or a schedule. With automated security off, the `m1._domainkey` TXT key is in your zone, so any change means editing the record yourself. ## Common mistakes - **Your domain doubled.** SendGrid notes that GoDaddy, Route 53 and Namecheap append the domain, so enter `s1._domainkey`, not `s1._domainkey.example.com`. - **Selector clash.** If another sender already publishes `s1._domainkey`, use a custom DKIM selector (three letters or numbers) instead of overwriting it. - **Turning off automated security to avoid underscores.** It swaps the CNAMEs for MX and TXT records, but SendGrid notes a DKIM record always contains an underscore (`m1._domainkey`), so a host that rejects underscores still can't publish it. - **Leftover records at the same name.** An old MX or TXT at the `em` host conflicts with the CNAME. **Q: What does SendGrid automated security change?** With it on, you publish CNAMEs and SendGrid manages your SPF, DKIM keys and key rotation behind them. With it off, you publish an MX record and TXT records for SPF and DKIM yourself, and must edit them when your SendGrid setup changes. **Q: Why does Gmail show "via sendgrid.net" on my emails?** Because the From domain isn't authenticated, so SendGrid signs with `sendgrid.net` instead of your domain. Authenticate the domain in Sender Authentication; afterward the signature uses your domain and the note goes away. **Q: Can I change the s1 and s2 DKIM selectors in SendGrid?** Yes. Under Advanced Settings, choose Use a custom DKIM selector and type three letters or numbers. Use it when another service at your domain already uses selectors starting with s. Sources: - Twilio SendGrid Docs: Configure domain authentication: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/how-to-set-up-domain-authentication - Twilio SendGrid Docs: Verify message integrity with DKIM: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/dkim-records - Twilio SendGrid Docs: Troubleshooting sender authentication: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/troubleshooting-sender-authentication --- Source: iBlockSpam, https://iblockspam.com/dkim/sendgrid (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt