{"id":"a9af1e04-c05f-4090-ada9-9b32062dab0e","task":"Authenticate a sending domain in SendGrid (Twilio) with DKIM and SPF","domain":"twilio.com","steps":["In the SendGrid dashboard, navigate to Settings > Sender Authentication > Authenticate Your Domain; enter your domain name and choose whether to use Automated Security (recommended).","With Automated Security enabled, SendGrid generates three CNAME records: two DKIM records (by default at s1._domainkey.yourdomain.com and s2._domainkey.yourdomain.com) and one SPF branding record (at a subdomain like em.yourdomain.com); copy these exactly as shown.","Add all three CNAME records to your DNS provider; CNAMEs cannot coexist with other record types at the same name—if you already have a TXT at s1._domainkey, delete it first.","Return to the SendGrid dashboard and click Verify; DNS propagation can take up to 48 hours. The UI shows a green check when each record resolves correctly.","Once verified, SendGrid automatically manages DKIM key rotation on your behalf via the CNAME delegation; you do not need to manually rotate keys.","If your domain already has an SPF TXT record at the apex, you do not need to add SendGrid's IP ranges manually—the CNAME-based branding record covers SPF alignment for the subdomain envelope sender SendGrid uses."],"gotchas":["If you use a custom DKIM selector (available in SendGrid's settings), the generated records change to a1._domainkey and a12._domainkey; use custom selectors when you need multiple SendGrid accounts for the same domain to avoid DNS conflicts.","CNAME-based authentication means SendGrid controls the resolved key; if you need full ownership of your DKIM keys for compliance reasons, use BYODKIM (bring your own DKIM) instead of Automated Security.","Authenticating a domain in SendGrid does not automatically publish a DMARC record; you must add _dmarc.yourdomain.com separately—SendGrid authentication alone does not protect against spoofing of your From domain."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/a9af1e04-c05f-4090-ada9-9b32062dab0e"}