Issue

Auto-SSL Custom Link Branding may be stuck on "SSL Certificate Provisioning" despite CNAME DNS records being verified in the SendGrid Console.

Product

Twilio SendGrid Email

Cause

When Auto-SSL is enabled, SendGrid uses Cloudflare to manage and issue SSL certificates for your branded link subdomains. Stalled provisioning is typically caused by a CAA Restriction. 

Certification Authority Authorization (CAA) records specify which Certificate Authorities (CAs) are allowed to issue SSL certificates for your domain. If your CAA records restrict issuance to specific CAs (e.g., GlobalSign or DigiCert) without permitting Cloudflare's CAs, certificate provisioning will fail.

Resolution

How to determine if there is a CAA restriction

1. Query the CAA record for the branded link subdomain:

dig <domain.com> CAA

(You can also use a third party service like whatsmydns.net and search for CAA records.)

2. If no CAA record exists on the subdomain, try the root domain:

dig <rootdomain.com> CAA

3. Look at the Answer section. If records like 0 issue "globalsign.com" appear without an entry for Cloudflare's CA (pki.goog), the policy is blocking issuance of the Twilio SendGrid created certificate.

Removing the CAA restriction

Add a CAA record permitting Google Trust Services (Cloudflare's CA for this setup) to your DNS records. You can review Cloudflare's documentation here. 

Verification

1. Allow 10-15 minutes for DNS changes to propagate.

2. In the SendGrid console, navigate to Settings > Sender Authentication > Link Branding 

3. Click the Link Branding domain. 

4. Click the Verify button. If the SSL certificate was able to be created, you'll see the following: