SendGrid 403 "from address does not match a verified Sender Identity"

What it means

Twilio SendGrid only lets you send from addresses you have verified. Your message used a From address that is neither a verified Single Sender nor part of an authenticated domain, so the Mail Send API answered with HTTP 403. The body usually looks like this:

{
  "errors": [{
    "message": "The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved. Visit https://sendgrid.com/docs/for-developers/sending-email/sender-identity/ to see the Sender Identity requirements",
    "field": "from",
    "help": null
  }]
}

Over SMTP (smtp.sendgrid.net), the same text comes back as a 550 error. Nothing was sent.

Why it happens

• No sender identity yet. New accounts must verify a Single Sender or authenticate a domain before sending.
• The Single Sender is not confirmed. SendGrid sent a verification email to that address and nobody clicked the link.
• Your code sends from another address. A Single Sender covers one exact address. If you verified hello@yourdomain.com but the app sends from noreply@yourdomain.com, it fails.
• A plugin overrides the From. WordPress, WooCommerce or a form plugin may send from wordpress@yourdomain.com or from the visitor's address. See contact form emails sent "From" the visitor's address.
• Subdomain mismatch. An authenticated domain covers the domain you authenticated. Check that the From domain is exactly the one listed (or a subdomain covered by it).
• Wrong account or subuser. Sender identities belong to the account or subuser that created them; an API key from another subuser does not see them.

A 403 can also come from an API key without the Mail Send permission; in that case the message is different (it talks about permissions or authorization, not Sender Identity).

How to check

1. Log the exact From address in the request (the from.email field in the API JSON, or the MAIL FROM and From header over SMTP).
2. In the SendGrid console, go to Settings > Sender Authentication. Look at the Single Sender list (is the address there and verified?) and the Domain Authentication list (is the domain there and verified?).
3. Confirm the API key belongs to the same account or subuser.

How to fix it

Option 1: verify a Single Sender (quick, for testing)

In Settings > Sender Authentication, choose to verify a single sender, enter the exact From address your code uses, then click the link in the email SendGrid sends to it. The mailbox must exist. SendGrid itself presents this as a testing option, not the best choice for production: the mail is not signed with your own domain.

Option 2: authenticate your domain (recommended)

Domain Authentication adds CNAME records to your DNS so SendGrid signs your mail with DKIM for your domain. After that, any address at the domain can be used as From, and DMARC can pass. If the records do not verify, read SendGrid domain authentication CNAME not verifying.

Fix the application

• Use one From address from your configuration everywhere. Example with the Node.js library:

  await sgMail.send({
    to: 'customer@example.com',
    from: { email: 'hello@yourdomain.com', name: 'Your Shop' },
    replyTo: 'support@yourdomain.com',
    subject: 'Your order',
    text: 'Thank you for your order.'
  });

• In WordPress SMTP plugins, set the From address and enable the option that forces it, so other plugins cannot override it.
• Never use a Gmail, Outlook or Yahoo address as From through SendGrid. You cannot authenticate those domains, and their DMARC policies cause rejections or spam placement.

Check that it is fixed

Send a message through your application to the unique address on the Delivmail home page. If SendGrid accepts it, the report appears. With Domain Authentication, DKIM should pass for yourdomain.com and DMARC should pass. With only a Single Sender, expect DKIM to be signed by SendGrid's domain instead, which is a reason to move to domain authentication. Then resend the message that failed. For general website sending problems, see emails from your website or WordPress go to spam.