SendGrid (Twilio)’s SPF include goes on a subdomain, not your root record.
Not on your root: SendGrid’s example puts it on the em#### return-path subdomain it assigns, and only when automated security is OFF. With automated security ON (the default), SendGrid manages SPF through a CNAME on that subdomain, so you add nothing to your root SPF record. Measured on 5 Nov 2026, the include costs 2 of your 10 SPF lookups, leaving 8 for everything else.
- Include
- sendgrid.net
- Vendor’s record
- em[0000].example.com TXT "v=spf1 include:sendgrid.net ~all"
- Where it goes
- A subdomain the service gives you
- Needed on your root?
- No, on the subdomain only
- Lookups (measured)
- 2 of 10
- Ranges published
- 15 ip4 · 0 ip6
- Category
- Transactional email
What include:sendgrid.net expands to live, 5 Nov 2026
v=spf1 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/18 ip4:159.26.176.0/20 include:ab.sendgrid.net ~all
Counted as RFC 7208 §4.6.4 does: the include itself plus every nested include, a, mx, ptr, exists and redirect. Includes can change at any time; this page re-measures daily.
DKIM for SendGrid (Twilio)
CNAMEs s1._domainkey and s2._domainkey (automated security on), or a TXT at m1._domainkey (off).
How it affects DMARC
DMARC passes when SPF or DKIM passes for a domain aligned with your From address. Because SendGrid (Twilio) authenticates SPF on its own or a delegated return-path domain, alignment for your From domain usually comes from DKIM, so set up its DKIM records for your domain.
Other transactional email services
Sources
- Twilio SendGrid: How to set up domain authentication · checked 5 Oct 2026
- RFC 7208 §4.6.4: DNS lookup limits · checked 5 Oct 2026
peekip isn’t affiliated with SendGrid; follow the vendor’s own setup page, which shows the exact values for your account.