SPF for SendGrid: Setup Guide and Best Practices

SendGrid is one of the most popular transactional email services, used by businesses of all sizes to send application emails, notifications, and marketing messages. Proper SPF configuration ensures your SendGrid emails authenticate correctly and reach the inbox.

The SendGrid SPF Include

To authorize SendGrid to send email for your domain, add this include statement to your SPF record:

include:sendgrid.net

This single include authorizes all of SendGrid's mail servers to send email on your behalf.

Setting Up SPF for SendGrid

If SendGrid is your only email service, your SPF record would look like:

v=spf1 include:sendgrid.net ~all

More commonly, you'll combine SendGrid with other services. Here's an example with Google Workspace:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Adding SendGrid to an Existing SPF Record

Already have an SPF record? Add SendGrid's include—don't create a second SPF record.

Before (without SendGrid):

v=spf1 include:_spf.google.com ~all

After (with SendGrid):

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Steps to update:

1. Log into your DNS provider
2. Find your existing TXT record starting with v=spf1
3. Add include:sendgrid.net before the ~all or -all
4. Save changes
5. Wait for DNS propagation (typically 1-4 hours)

SendGrid Domain Authentication

SPF is just one part of SendGrid's domain authentication. For best deliverability, SendGrid recommends completing their full domain authentication process, which includes:

SPF — Authorizes SendGrid's servers (what this article covers)

DKIM — Adds cryptographic signatures to your emails. SendGrid provides CNAME records to add to your DNS.

Link branding — Customizes tracking links to use your domain instead of sendgrid.net

To set up full domain authentication:

1. Log into your SendGrid account
2. Go to Settings → Sender Authentication
3. Click "Authenticate Your Domain"
4. Follow the wizard to get your DNS records
5. Add all provided records to your DNS

Common SendGrid SPF Issues

Emails still failing SPF after adding SendGrid

Check the sending domain. SendGrid allows you to send from different domains. Make sure the domain in your "From" address has the SPF record with SendGrid included.

Verify DNS propagation. Changes can take up to 48 hours to fully propagate. Use a lookup tool to confirm your record is published correctly.

Check for typos. Ensure you've typed sendgrid.net exactly—not sendgrid.com or any variation.

Using SendGrid with a subdomain

If you're sending from a subdomain (like mail.yourdomain.com), that subdomain needs its own SPF record. SPF records don't automatically inherit from parent domains.

mail.yourdomain.com TXT "v=spf1 include:sendgrid.net ~all"

Hitting the 10 DNS lookup limit

SendGrid's include is relatively lightweight (1-2 lookups), but if you're using many email services, you might approach the limit. Check your total lookup count and see our guide on the SPF 10 DNS lookup limit if you're running into issues.

SendGrid IP Pools and Dedicated IPs

If you're on a SendGrid plan with dedicated IP addresses, you have two options for SPF:

Option 1: Use the include (recommended)

v=spf1 include:sendgrid.net ~all

This covers all SendGrid IPs, including your dedicated ones. It's simpler and automatically handles any IP changes.

Option 2: Use specific IPs

v=spf1 ip4:your.dedicated.ip ~all

This only authorizes your specific IP. You'd need to update your SPF record if SendGrid changes your IP. Only use this approach if you have a specific reason to restrict authorization.

Verifying Your SendGrid SPF Setup

After making DNS changes, verify everything is working:

1. Check your SPF record

Use the lookup tool above to confirm your record includes sendgrid.net.

2. Send a test email

Send an email through SendGrid to an address you can check (Gmail works well). Open the email and view the original headers. Look for:

spf=pass (sendgrid.net: domain of you@yourdomain.com designates [IP] as permitted sender)

3. Check SendGrid's dashboard

SendGrid's Activity Feed shows authentication status for sent emails. Look for SPF pass indicators.

4. Use SendGrid's validation

In Settings → Sender Authentication, SendGrid can verify your DNS records are configured correctly.

SendGrid with Other Email Services

Most businesses use SendGrid alongside other email services. Here are common combinations:

SendGrid + Google Workspace:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

SendGrid + Microsoft 365:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all

SendGrid + Multiple services:

v=spf1 include:_spf.google.com include:sendgrid.net include:amazonses.com ~all

Remember to check your DNS lookup count when combining multiple services. Each include adds to your total.

SPF, DKIM, and DMARC for SendGrid

For complete email authentication, configure all three:

SPF — You've got this covered with the include statement.

DKIM — Set up through SendGrid's Sender Authentication. They provide CNAME records that enable DKIM signing.

DMARC — Once SPF and DKIM are working, add a DMARC record to tell receivers how to handle authentication failures.

Together, these protocols maximize your deliverability and protect your domain from spoofing.

Monitor Your SPF Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.