Add three CNAME records and SendGrid signs your mail as you — the whole thing is a five-minute job, not an afternoon.
This is the entire click-path from a fresh login to a verified domain. Nothing else — follow the crumbs.
Sign in at app.sendgrid.com. SendGrid now requires two-factor on every account, so have your authenticator app or passkey ready.
In the left rail open Settings, then Sender Authentication. This is the only screen you need; ignore the Single Sender option, which is for one-off addresses and does not authenticate a domain.
Under Domain Authentication click Get Started (or Authenticate Your Domain). Pick your DNS host from the dropdown — it only changes the help text, not the records.
Enter the root domain you send from, for example example.com. Leave Brand the links / Use automated security on; automated security is what lets SendGrid rotate DKIM keys for you later without you touching DNS again.
SendGrid generates three CNAME records: one for the return-path (s1/s2 domainkey) and two DKIM selectors. Copy them exactly — the host values are long and case-insensitive, but a trailing-dot mistake will break them.
em1234.example.com CNAME u1234567.wl.sendgrid.net s1._domainkey.example.com CNAME s1.domainkey.u1234567.wl.sendgrid.net s2._domainkey.example.com CNAME s2.domainkey.u1234567.wl.sendgrid.net
In your DNS provider (Cloudflare, Route 53, your registrar) add each as a CNAME. On Cloudflare set the proxy status to DNS only (grey cloud) — an orange-clouded CNAME will not resolve for mail authentication.
Do not add your own trailing dot if the host field already implies the zone; most panels append the domain for you.
Back in SendGrid press Verify. DNS usually propagates in a couple of minutes but can take up to an hour. A green check on all three rows means you are done and mail will now be signed as your domain.
Verify keeps failing after 10 minutes.
Check the record type is CNAME, not A or TXT, and that the host has no duplicate domain suffix (example.com.example.com). Use a DNS lookup tool to confirm the value resolves before retrying.
Records added on Cloudflare but still failing.
Switch the three records from Proxied (orange cloud) to DNS only (grey cloud). Proxying rewrites CNAME targets and breaks authentication.
DKIM passes but mail still lands in spam.
Domain authentication only covers SPF/DKIM alignment. Publish a DMARC record too, and warm up volume gradually on a new domain.
You already had an em/ DKIM record from an old setup.
Delete the stale CNAMEs first. Conflicting old selectors cause SendGrid to read the wrong values and report a partial failure.
Written and maintained by Ben McDaniel. Drafted with AI assistance and human-reviewed against each vendor's current setup flow. Vendor interfaces change — if a step looks different, the underlying record is what matters.