SendGrid authenticates best with domain authentication (CNAMEs), not a raw SPF include. In SendGrid, set up Sender Authentication for your domain and publish the CNAME records it generates (for the return-path and the s1/s2 DKIM selectors). This gives you aligned SPF and DKIM so email passes DMARC.
SendGrid’s Sender Authentication publishes a branded return-path and DKIM under your own domain, which is what DMARC alignment needs. The old include:sendgrid.net alone authenticates SendGrid’s domain, not yours, so SPF can pass while DMARC fails.
In SendGrid: Settings → Sender Authentication → Authenticate Your Domain. Add the 3+ CNAME records it gives you (e.g. em1234, s1._domainkey, s2._domainkey) to your DNS, then click Verify.
After publishing:
$ dig CNAME s1._domainkey.yourdomain.com +shortCheck your SPF record now
Open the free SPF checker →If you use SendGrid’s domain authentication (recommended), you don’t add the shared include — the CNAME return-path handles aligned SPF. Mixing both can waste SPF lookups.
So SendGrid can rotate keys without you editing DNS — the CNAME points at SendGrid-managed records.
