# SPF record for SendGrid (Twilio)

URL: https://iblockspam.com/spf/sendgrid
Last updated: 2026-10-09

Include: include:sendgrid.net
Where it goes: SendGrid's return-path subdomain (em1234)
DNS lookups: 2 of 10

With SendGrid domain authentication, SPF is handled on a return-path subdomain such as em1234.example.com. With automated security on (the default), a CNAME on that subdomain covers SPF. With it off, SendGrid asks for a TXT record there: v=spf1 include:sendgrid.net ~all. The include costs 2 DNS lookups.

## Example records

- Automated security off: TXT on the return-path subdomain SendGrid gives you (TXT, host em1234): `v=spf1 include:sendgrid.net ~all` Use the exact subdomain SendGrid shows; em1234 is an example. SendGrid also asks for an MX record there: mx.sendgrid.net.
- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- SendGrid's SPF article shows `v=spf1 include:sendgrid.net -all` as a typical record. With domain authentication, that record belongs on the return-path subdomain, which is the domain SPF actually checks for SendGrid mail.
- With automated security on, SendGrid updates the SPF and DKIM records for you, for example when you add a dedicated IP address. With it off, you must update them yourself.

## How to add it

- In SendGrid, start domain authentication for the domain you send from (for example `example.com`).
- Under Advanced Settings, keep Use automated security on unless your DNS host can't store underscores in CNAME records.
- Optionally set a custom return path if you need a specific subdomain label instead of SendGrid's random one.
- Publish exactly the records SendGrid shows: with automated security, one CNAME for the return path (SPF), two DKIM CNAMEs and a DMARC TXT record.
- Verify in SendGrid, then check the return-path subdomain with the SPF Checker below.

## DKIM and DMARC

With automated security on, DKIM uses two CNAMEs (`s1._domainkey` and `s2._domainkey`) that point to SendGrid; with it off, a DKIM TXT record (`m1._domainkey`). Because the return path is a subdomain of your From domain, SPF aligns under DMARC's default relaxed alignment, and DKIM aligns too.

## Common mistakes

- Adding `include:sendgrid.net` to your root record when you've already authenticated the domain. SPF for SendGrid mail is checked on the return-path subdomain, so the root include spends 2 lookups for nothing.
- A custom return-path CNAME that matches an existing CNAME overwrites it. Check your DNS first.

**Q: Do I need include:sendgrid.net in my SPF record?**
Not in your root record if you use SendGrid's domain authentication. SPF is checked on the return-path subdomain SendGrid creates (for example `em1234.example.com`). With automated security on, a CNAME there covers it; with it off, you publish `v=spf1 include:sendgrid.net ~all` on that subdomain.

**Q: What does SendGrid's automated security do?**
It lets SendGrid host and update your SPF and DKIM records through CNAMEs, for example when you add a dedicated IP. It is on by default. Turn it off only if your DNS host can't accept underscores in CNAME records.

**Q: Does SendGrid mail pass DMARC?**
Once domain authentication is complete, yes: DKIM signs with your domain and the return path is a subdomain of it, so both align under DMARC's relaxed default. Publish a [DMARC record](https://iblockspam.com/blog/dmarc-record-examples) on your main domain.

Sources:
- Twilio SendGrid Docs: Set up domain authentication: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/how-to-set-up-domain-authentication
- Twilio SendGrid Docs: Verify senders with SPF: https://www.twilio.com/docs/sendgrid/ui/sending-email/verify-sender-with-spf

---

Source: iBlockSpam, https://iblockspam.com/spf/sendgrid (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt