SendGrid: Why It's in Your DNS and What It Does for Your Email

What Is SendGrid?

You just ran a TechSpy scan on your domain, scanned through the results, and spotted something that made you pause: "SPF includes: sendgrid.net" or maybe a cryptic DKIM selector starting with "s1." You didn't set that up. Is someone using your domain to send spam? Did you get hacked? Most likely, it's not a security breach—it's a tool your company started using. Let's unpack what SendGrid is, why it appears in your domain's DNS (the internet's phonebook that directs traffic and stores permissions), and whether it belongs there.

SendGrid is a cloud-based service that sends email on behalf of your business—things like marketing newsletters, password reset links, order confirmations, and receipts. It's owned by Twilio, the communications platform used by millions of companies. Instead of sending these emails from your regular mailbox (like Google Workspace or Microsoft 365), you route them through SendGrid to improve deliverability and handle large volumes.

When your team set up SendGrid, they gave it permission to send email that looks like it comes from your domain. That permission lives in your DNS as a record—specifically an SPF record (Sender Policy Framework, a list of who's allowed to send email for your domain) and often a DKIM record (DomainKeys Identified Mail, a digital signature that proves the email hasn't been tampered with). Seeing "sendgrid.net" in your SPF or a DKIM selector like is the digital equivalent of giving SendGrid a badge that says, "I'm allowed to deliver mail for this company."

Real-World Analogy

Think of it like hiring a courier service to handle your office's outgoing packages. You give the courier a signed authorization letter they can show at the shipping dock. The dock workers check your file and see the courier is on the approved list—so they accept the packages. SendGrid is that courier, and your SPF and DKIM records are the authorization letter.

How SendGrid Works

Here's the step-by-step, plain-English version.

You've just scheduled a big marketing email to 5,000 customers. Your marketing platform (like HubSpot or Salesforce) passes the email to SendGrid. SendGrid stamps the email with a hidden digital code—a signature that only your domain could authorize, thanks to that DKIM record. Then SendGrid sends the email out through its own trusted servers.

When your customer's email provider (say, Gmail) receives the message, it immediately checks two things: did this email really come from a server allowed to send for your domain? And does the digital signature match the public key stored in your domain's DNS? If both checks pass, Gmail trusts the email and puts it in the inbox. If you didn't have those DNS records, or they were wrong, the email might land in spam or get rejected outright.

In short: your DNS records act as an official guest list. SendGrid shows its badge at the door, the bouncer checks the list, and if the badge matches, you're in.

Technical Details

▸SPF: — The tells receiving servers to also trust all IP addresses listed in SendGrid's own SPF record. This adds SendGrid's sending infrastructure to your authorized list.

▸DKIM: SendGrid typically uses selectors like , , or sometimes . The public key lives in a TXT record at . A valid DKIM signature from SendGrid will reference one of those selectors.

▸Return-Path: SendGrid may also set up a custom return path (like ) via a CNAME record pointing to . This helps track bounces without exposing your main domain.

▸TechSpy detection: When TechSpy finds in SPF, or DKIM selectors with a record containing , or CNAMEs for domain authentication, it flags the presence of SendGrid.

Why It Matters for Your Business

When SendGrid is configured correctly, your email deliverability gets a real boost. Marketing emails reach inboxes instead of spam folders, transactional messages (receipts, password resets) arrive reliably, and your domain builds a reputation as a trustworthy sender. This isn't just a nice-to-have—major inbox providers like Google and Yahoo now require proper email authentication, and using a recognized service like SendGrid makes meeting those requirements straightforward.

If the configuration is wrong or outdated, the consequences are felt across the whole business. Emails might bounce silently, customers never see your shipping confirmations, or worse—your domain's reputation score drops and even regular, one-to-one emails start going to spam. Unused SendGrid records are equally dangerous: if a former vendor or an unauthorized person still has SPF includes or DKIM keys active, they could send emails that look exactly like they came from your business. That's a fast track to phishing attacks and customer trust erosion.

This isn't just an IT concern. Marketing teams rely on open rates and click-throughs; support teams depend on customers receiving their messages; sales sequences fall apart if emails never arrive. Even your CEO should care, because a damaged domain reputation can blacklist the entire company's communication.

Common Issues and Warning Signs

You might not know there's a problem until an email campaign bombs or a TechSpy scan flags something unexpected. These are the symptoms that suggest your SendGrid DNS setup needs attention.

Common Issues

You've never heard of SendGrid, but TechSpy shows in your SPF record. This could mean a marketing tool added it without your knowledge—or it's left over from a previous vendor. It's worth verifying.

Your marketing emails suddenly land in spam, and your DKIM record uses a selector like but the key doesn't match SendGrid's. A common misconfiguration during a migration or domain change.

You have multiple SPF records (you should only ever have one) or your SPF record exceeds 10 DNS lookups. Adding on top of many other includes can break SPF authentication completely.

You switched email providers or marketing platforms, but the old SendGrid records are still in your DNS. That can confuse deliverability and create security gaps.

How to Fix or Improve SendGrid Configuration

Whether you need SendGrid or not, you can get this cleaned up in a few minutes—once you know who set it up. The path depends on whether your company actually uses SendGrid.

Once you've made your changes, run another TechSpy scan to confirm everything is clean. That scan is free and takes under a minute—it's the quickest way to be sure your domain is talking to the right courier.

1Ask the person who manages your email marketing: Do we use SendGrid? Check with your marketing lead, IT staff, or the agency that built your website. If no one knows, log in to sendgrid.com with any company email for a password reset to see if an account exists.

2If you do NOT use SendGrid: Remove the records. In your DNS management panel, edit the TXT record that starts with and delete the part—carefully, without breaking the rest. For DKIM, find TXT records for selectors like , , etc., and remove them. If you ever used the custom return-path, delete the CNAME that points to .

3If you DO use SendGrid: Follow SendGrid’s Domain Authentication guide. Usually you'll add a few CNAME records provided in their dashboard that point to for DKIM and the return path. Make sure your single SPF record includes , and verify that the DKIM selector matches what SendGrid gave you.

4If someone else manages your DNS (IT, agency, hosting provider), forward this article to them and ask: "Can you review our SPF and DKIM records for SendGrid entries and confirm they match our current email setup?" They can cross-check with the TechSpy scan to see what's live.