SendGrid production sender identity: domain auth plus reverse DNS

TL;DR

Set up domain authentication in Settings > Sender Authentication. Add the SPF, DKIM, and DMARC TXT records to your DNS.

Steps

1. Goal: a sending identity mailbox providers trust.

1. Step 1. Verify at least one sender identity immediately. Twilio requires authentication or verification before real sending; single sender verification covers one address for tests.

1. Step 2. Set up domain authentication in Settings > Sender Authentication. Add the SPF, DKIM, and DMARC TXT records to your DNS. Optionally brand the links and use a subdomain for sending.

1. Step 3. Validate in the console until all records show green. DNS propagation can take a day; do not send production volume from the domain until it validates.

1. Step 4. On a dedicated IP, set up reverse DNS: add the DNS record SendGrid provides and an A record mapping your domain to the IP. The circular check is A record domain to IP, rDNS IP back to domain.

1. Step 5. Send test messages to seed addresses at major providers and confirm headers show SPF/DKIM passing and DMARC aligned.

1. Verify: console shows domain auth validated, rDNS validated, and test headers pass all three checks. Pitfall: changing DNS or the sending domain later silently breaks alignment; re-validate after any change.

When to use

You are seeing this: Goal: a sending identity mailbox providers trust. Use this skill when you run into "SendGrid production sender identity: domain auth plus reverse DNS".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.