How to set up DKIM for SendGrid (Twilio)
DKIM signs your outgoing mail with a key only your sender holds, and publishes the matching public key in DNS. It can't be generated by a checker — the key comes from SendGrid (Twilio)'s console — so this guide walks the console flow and the record you'll publish.
What you'll publish: With Automated Security (the default): two CNAMEs — s1._domainkey and s2._domainkey pointing at …sendgrid.net targets — plus an em#### mail CNAME. With Automated Security off: a single TXT at m1._domainkey.
Steps
- In the SendGrid console, open Settings → Sender Authentication → Domain Authentication → Get Started.
- Answer the DNS-host questions and SendGrid shows the exact records for your account.
- Publish them, then click Verify.
Gotchas
- ⚠GoDaddy, Route 53, and Namecheap auto-append your domain — enter only the prefix (em1234, s1._domainkey), or you'll create em1234.example.com.example.com.
- ⚠If your DNS provider doesn't accept underscores in CNAME names, Automated Security can't be used — switch it off and use the TXT path.
- ⚠On Cloudflare, the CNAMEs must be DNS-only (gray cloud), not proxied.
Steps verified against SendGrid: domain authentication on 2026-07-17.
Verify it worked
After publishing, run the free DKIM checker — it probes the common selectors and shows your key the way receivers see it.
Run the DKIM checker →