Email Authentication (SPF/DKIM/DMARC)
Overview
Multiple authentication technologies are combined in modern email sending and receiving to prevent email spoofing (phishing and spam).
| Technology | Purpose |
|---|---|
| SPF | Validates the IP address of the sending server |
| DKIM | Guarantees email authenticity and integrity via digital signature |
| DMARC | Integrates SPF/DKIM results as policy and instructs recipients how to handle failures |
Properly configuring these three technologies improves email deliverability and strengthens brand trust.
SPF (Sender Policy Framework)
How It Works
SPF publishes a list of authorized IP addresses for a given domain in DNS. The receiving server verifies the sender's legitimacy by looking up the SPF record for the domain in the Envelope From (Return-Path) of the email.
Example DNS TXT Record
v=spf1 include:sendgrid.net ~all
| Element | Description |
|---|---|
v=spf1 | SPF version 1 |
include:sendgrid.net | Include SendGrid's IP address set in the allowed list |
~all | SoftFail for senders not in the list (treat as warning) |
-all | HardFail for senders not in the list (reject) |
- Only one TXT record per domain is valid for SPF. Multiple records will be invalidated.
- Too many nested
includelookups (more than 10) will cause DNS lookup errors. - SPF alone tends to break during email forwarding, so combining it with DKIM is important.
DKIM (DomainKeys Identified Mail)
How It Works
DKIM uses digital signatures to prove email authenticity. The sender (e.g., SendGrid) signs the email headers and body with a private key, and the receiver verifies it using the public key published in DNS.
Example DKIM Signature (Email Header)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;
s=s1; h=from:to:subject:date; bh=...; b=...
| Field | Description |
|---|---|
d= | Signing domain (used for DMARC Alignment) |
s= | Selector (used in DNS lookup path) |
h= | Header fields included in the signature |
bh= | Hash of the email body |
b= | Signature value |
What Is a DKIM Selector?
A selector is a string used to uniquely identify a DKIM public key in DNS. It enables managing multiple key pairs for a single domain.
{selector}._domainkey.{domain}
For example, if SendGrid instructs you to use DKIM Selector: sgqcd, the DNS record name for looking up the public key becomes:
sgqcd._domainkey.example.com
Why Have Multiple Selectors?
| Use Case | Example |
|---|---|
| Using multiple email sending services | SendGrid: sgqcd, internal MTA: mail |
| Key rotation (transition period between old and new keys) | Old key: v1, new key: v2 |
| Environment isolation (production / staging) | Production: prod, staging: stg |
Selector names like sgqcd from SendGrid are unique identifiers auto-generated by SendGrid. These names are determined by SendGrid's Automated Security and cannot be changed arbitrarily.
When using CNAME records, the actual DNS entry looks like:
sgqcd._domainkey.example.com→sgqcd.domainkey.u1234567.wl.sendgrid.net
(Use the actual CNAME value issued from the SendGrid dashboard.)
Example DNS TXT Record (Public Key)
For selector s1 and domain example.com:
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."
DMARC (Domain-based Message Authentication, Reporting & Conformance)
How It Works
DMARC integrates SPF and DKIM verification results as a policy and instructs receiving servers on how to handle them. It also provides reporting functionality, sending reports on authentication failures back to the sender.
Alignment Concept
What makes DMARC powerful is not just pass/fail authentication, but its requirement for Alignment — the match between the From header domain and the authenticated domain.
| Technology | What Is Checked for Alignment |
|---|---|
| SPF Alignment | Envelope From (Return-Path) domain vs. From header domain |
| DKIM Alignment | d= tag in DKIM-Signature vs. From header domain |
Example DMARC TXT Record
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-report@example.com; pct=100"
| Tag | Description |
|---|---|
v=DMARC1 | DMARC version |
p= | Policy (none / quarantine / reject) |
rua= | Email address for aggregate reports |
ruf= | Email address for individual forensic reports |
pct= | Percentage of messages to apply policy to (useful for gradual rollout) |
DMARC Rollout Phases
| Phase | Policy | Purpose |
|---|---|---|
| Monitoring | p=none | Understand current state (normal email delivery continues) |
| Gradual enforcement | p=quarantine; pct=10 | Gradually increase the enforcement percentage |
| Full enforcement | p=reject | Fully block spoofed emails |
Starting with p=reject immediately risks blocking your own legitimate emails if misconfigured. Start with p=none, analyze reports, and gradually strengthen enforcement.
Envelope From (Return-Path) vs. From Header
Emails have multiple "sender" addresses. Understanding this distinction is critical for DMARC configuration.
┌─────────────────────────────────────────────────────────┐
│ SMTP Envelope │
│ Envelope From: bounce@sendgrid.net ← Return-Path (bounce destination) │
│ │
│ ┌────────────────────────────────────────────────────┐ │
│ │ Email Headers │ │
│ │ From: sender@yourdomain.com ← From address visible to users │
│ │ To: recipient@example.com │ │
│ │ Subject: ... │ │
│ └────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘
| Item | Role | DMARC Alignment |
|---|---|---|
| Envelope From (Return-Path) | Bounce return address. Used in SMTP communication | SPF verification target |
| From Header | Sender address shown in email clients | DMARC reference domain |
| DKIM d= Tag | Domain that created the signature | DKIM Alignment verification target |
In SendGrid's default configuration, the Envelope From becomes a SendGrid domain like bounce.xxx.sendgrid.net. Sender Authentication must be configured to unify this under your custom domain.
SendGrid Domain Authentication (Sender Authentication)
Overview
This configuration allows emails sent via SendGrid to pass SPF/DKIM authentication using your own domain (e.g., example.com). It works by adding CNAME records to your DNS.
Automated Security (Recommended)
With SendGrid's Automated Security, there is no need to add TXT records directly to DNS — SendGrid manages authentication automatically via CNAME.
CNAME Record Structure
Automated Security generates the following 3 CNAME records:
| Purpose | DNS Name (Host) | Points To (Value) |
|---|---|---|
| Mail subdomain (Envelope From) | em1234.example.com | u1234567.wl.sendgrid.net |
| DKIM public key (1st) | s1._domainkey.example.com | s1.domainkey.u1234567.wl.sendgrid.net |
| DKIM public key (2nd) | s2._domainkey.example.com | s2.domainkey.u1234567.wl.sendgrid.net |
The above values are samples. Use the actual CNAME records generated from the SendGrid dashboard.
Setup Steps
-
Log in to the SendGrid dashboard
- Navigate to Settings → Sender Authentication → Click "Authenticate Your Domain"
-
Enter domain information
- Select your DNS host (e.g., AWS Route 53, Cloudflare, etc.)
- Enter the domain to authenticate (e.g.,
example.com) - Confirm that "Use automated security" is checked
-
CNAME records are generated
- Note down the 3 CNAME records displayed
-
Register CNAMEs with your DNS provider
- Add the 3 CNAME records to your DNS management console
- DNS propagation may take up to 48 hours
-
Run Verify in SendGrid dashboard
- Navigate to Settings → Sender Authentication → Click "Verify" for the target domain
- Authentication is complete when all 3 records show checkmarks
Troubleshooting Verify Failures
| Cause | Resolution |
|---|---|
| CNAMEs not yet propagated to DNS | Wait a few hours up to 48 hours, then retry |
| Typo in CNAME value | Recheck records in your DNS management console |
| Conflict with existing DKIM records | Delete old TXT records |
| Long TTL setting | Reduce TTL to speed up propagation |
Email Sending Flow After Configuration
Summary
| Configuration | DNS Record Type | Effect |
|---|---|---|
| SPF | TXT record (replaced by CNAME with Automated Security) | Proves legitimacy of sending server IP |
| DKIM | TXT record (replaced by CNAME with Automated Security) | Proves integrity via email signature |
| DMARC | TXT record (_dmarc. prefix) | Applies integrated SPF/DKIM policy |
| SendGrid Sender Authentication | 3 CNAME records | Unifies Envelope From and DKIM signing domain under custom domain |
- Start by enabling DMARC with
p=noneand analyze reports to understand current authentication status - Using SendGrid's Automated Security simplifies SPF/DKIM management significantly
- Regularly review reports arriving at the
rua=address to check for unauthorized senders - Ultimately set
p=rejectto fully block spoofed emails