MailFixIt

SendGrid email configuration guide

SendGrid: DKIM record not verifying

One or more SendGrid Domain Authentication CNAMEs is missing or wrong, or the message was sent through a different authenticated domain.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

The DNS records do not exactly match the CNAMEs generated by SendGrid Domain Authentication, or the failing message used another authenticated domain.

Fix it

  1. Open the exact authenticated domain in SendGrid and note whether Automated Security is enabled.
  2. Copy every generated host and CNAME target; use the values from this account and domain, not a generic example.
  3. Publish them in the authoritative DNS zone without a duplicated domain suffix, proxying, flattening, or changing CNAME to TXT.
  4. Keep unrelated DKIM selectors used by other active senders.
  5. Ask SendGrid to verify the domain, send a new message through that authentication, and confirm its d=, s=, and dkim=pass values.

Common mistake

A verified Link Branding domain is not the same as an authenticated sending domain. Correct DNS also does not prove the application selected that authentication when it sent the message.

What MailFixIt can check

MailFixIt can query public DKIM records for a supplied selector. It cannot see SendGrid account state or API configuration.

Use the related DKIM guide when the selector is absent, points incorrectly, or resolves to an invalid key.

Frequently asked questions

What does MailFixIt check for SendGrid?

It can inspect the public selector you provide and detect missing or malformed DNS. SendGrid must confirm Domain Authentication and active signing.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: SendGrid official setup guidance.