SendGrid 403 from address does not match a verified Sender Identity

TL;DR

Different message, different fix. Check which address the request actually sends from, including per-personalization from overrides.

Steps

1. Symptom: 403 with an errors entry saying the from address does not match a verified Sender Identity.

1. Confirm it is not a scope 403: this message names the from address. A scope 403 talks about access. Different message, different fix.
2. Check which address the request actually sends from, including per-personalization from overrides. The top-level from is not always the one being checked.
3. Fix option A, domain authentication (production): Settings > Sender Authentication > Authenticate Your Domain, add the DNS records, validate. Every address on the domain then verifies automatically.
4. Fix option B, single sender (testing): Verify a Single Sender, fill the form, click the link in the verification email. No click, no sending.
5. Common trap: the address is verified but spelled differently in the request (typo, different subdomain, plus-addressing). The match is exact.

1. Do not work around this with someone else's verified address. Authenticate the domain you actually send from.

When to use

You are seeing this: Symptom: 403 with an errors entry saying the from address does not match a verified Sender Identity. Use this skill when you run into "SendGrid 403 from address does not match a verified Sender Identity".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.