SendGrid domain authentication CNAME records not verifying: fix

What it means

In Twilio SendGrid, Domain Authentication (Settings > Sender Authentication) asks you to publish DNS records, then click Verify. If SendGrid cannot find them with the right value, it shows the records as not verified and your domain stays unauthenticated.

With "Use automated security" turned on (the default), SendGrid gives you three CNAME records and suggests a DMARC record. The names and targets contain numbers that are unique to your account:

em1234.yourdomain.com            CNAME  u1234567.wl123.sendgrid.net
s1._domainkey.yourdomain.com     CNAME  s1.domainkey.u1234567.wl123.sendgrid.net
s2._domainkey.yourdomain.com     CNAME  s2.domainkey.u1234567.wl123.sendgrid.net
_dmarc.yourdomain.com            TXT    "v=DMARC1; p=none;"

The em record is used for the Return-Path (bounce domain, which makes SPF align). The two _domainkey records point to DKIM keys that SendGrid rotates for you. Always copy your own values from the console; the ones above are examples.

Why it happens

• Doubled domain name. Your DNS panel adds yourdomain.com automatically, so em1234.yourdomain.com becomes em1234.yourdomain.com.yourdomain.com. This is the most common cause; see DNS record added at the wrong name.
• Cloudflare proxy. A proxied CNAME (orange cloud) answers with Cloudflare IP addresses instead of the CNAME target. See Cloudflare proxied records break email.
• A conflicting record. A CNAME cannot exist next to another record with the same name. An old TXT or MX at em1234 or s1._domainkey blocks it. See CNAME conflicts with MX and TXT records.
• Typo in the target, or a trailing dot problem in panels that expect a fully qualified name.
• Records added in the wrong DNS zone. Your domain's DNS is served by another provider (check the NS records), so records added at your registrar are never seen.
• Not visible yet. Some DNS hosts take time to publish new records; SendGrid mentions up to 48 hours for some providers.
• Wrong domain authenticated: you authenticated yourdomain.com but added records for a subdomain, or the reverse.

How to check

1. Query each record from a terminal. A correct answer returns the SendGrid target:

   dig +short CNAME em1234.yourdomain.com
   dig +short CNAME s1._domainkey.yourdomain.com
   dig +short CNAME s2._domainkey.yourdomain.com
   dig +short NS yourdomain.com

   An empty answer means the record is not there (or not yet). IP addresses mean a proxy.
2. Check for the doubled name: dig +short CNAME em1234.yourdomain.com.yourdomain.com. If that answers, the name was entered wrong.
3. Use the Delivmail domain scanner to see the SPF, DMARC and DKIM records others see for your domain.

How to fix it

1. In your DNS panel, open each record and enter only the part before your domain in the name field: em1234, s1._domainkey, s2._domainkey.
2. Paste the target exactly as SendGrid shows it. Set the record type to CNAME, not TXT.
3. On Cloudflare, switch each record to "DNS only".
4. Delete old records with the same names, including old DKIM TXT records for s1/s2 from a previous setup.
5. Make sure you edit the zone of the DNS provider shown in your NS records.
6. If your DNS host refuses underscores in CNAME names, turn off automated security in SendGrid (it then gives MX and TXT records instead), or move your DNS to a host that supports standard records.
7. Back in SendGrid, click Verify. If one record still fails, SendGrid shows which one.

SPF and existing records

With automated security, you do not need to add SendGrid to your root SPF record: SPF is checked on the em subdomain, which follows SendGrid's SPF through the CNAME. Keep your existing root SPF for your other services. For how CNAME-based DKIM works, see DKIM with CNAME records (delegated selectors).

Check that it is fixed

When dig returns the right targets, click Verify again in SendGrid; all records should turn green. Then send a test through SendGrid to the address on the Delivmail home page: DKIM should pass with d=yourdomain.com, the Return-Path should be on em1234.yourdomain.com, and DMARC should pass. If records are correct but SendGrid still does not verify after the propagation delay, contact SendGrid support with your dig output.