Twilio SendGrid email authentication

One of the largest transactional and marketing sending platforms.

SendGrid now pushes "authenticated domains", which use CNAMEs instead of this include. Use whichever its dashboard shows you.

SPF record

Add Twilio SendGrid to your domain's SPF record with this include:

include:sendgrid.net

A complete record for a domain sending only through Twilio SendGrid:

v=spf1 include:sendgrid.net ~all

What it costs you

2 of your 10 DNS lookups. The include: itself costs one, and Twilio SendGrid's record chains to 1 more. Behind it are 15 IP ranges.

Live record

This is what sendgrid.net published when this page was generated:

v=spf1 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/19 ip4:134.128.96.0/19 include:ab.sendgrid.net ~all

Domains using Twilio SendGrid

Found while resolving 293 well-known domains on 2026-08-04 — each authorises sendgrid.net in its published SPF record:

DKIM

Enable DKIM inside Twilio SendGrid and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.

DMARC

Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them to it. Once Twilio SendGrid is authenticating, publish a DMARC record — start at p=none with a reporting address and tighten from there.

Generate a DMARC record →

Check it worked

DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.