Issue

You may notice that your authenticated domain appears as verified, but SPF and DKIM authentication fail when sending emails.

Product

Twilio SendGrid (Email)

Cause

There are two common scenarios that can result in this behavior:

Scenario 1: EU-Pinned Domain

If the domain was authenticated using the EU-Pinned option, it can only be used with an EU subuser. To confirm whether the domain is EU-pinned, open the authenticated domain in your SendGrid account and check the DNS records. If the records include eu, the domain is EU-pinned.

Scenario 2: Missing CNAME Records

If the required CNAME records have been removed from your DNS provider, SPF and DKIM authentication will fail even if the domain previously appeared to be authenticated.

Resolution

For Scenario 1: EU-Pinned Domain

EU-pinned domains are supported only with EU subusers. If the domain was authenticated under the parent account, assign the authenticated domain to the appropriate EU subuser before sending email. Once assigned, retry sending the email and verify that SPF and DKIM authentication pass.

For Scenario 2: Missing CNAME Records

• In your SendGrid account, navigate to the authenticated domain and click Verify.
• If the verification fails, compare the required DNS records with those currently configured in your DNS provider.
• Re-add any missing or incorrect CNAME records.
• After the DNS changes have propagated, click Verify again to confirm that the domain is successfully authenticated.
• Once verification succeeds, send a test email to confirm that SPF and DKIM authentication pass.

Related links:

How to set up Domain Authentication