How to Set Up Domain Authentication

To determine which hostnames in a domain point to which IP addresses, the Domain Name Service checks each domain's records.

For example: DNS translates the hostname for an email server that humans can remember, like email.example.com, to an IP address.

DNS includes many types of records. Each domain must include at least one of these records.

• An A record maps a domain to an IPv4 address.
• An AAAA record maps a domain to an IPv6 address.
• A Canonical Name (CNAME) record maps one domain to another domain or host.
• A Mail Exchanger (MX) record direct incoming email to the correct host for the domain.
• A TXT record stores arbitrary text for a domain. These records often get used for email security and administration.

Your DNS provider manages your DNS records so you can set and remove DNS entries for your domain.

To learn more, see the Guide to Understanding DNS Record Types.

Authenticating email through DNS uses three types of authentication:

• DomainKeys Identified Mail (DKIM)
• Sender Policy Framework (SPF)
• Domain-based Message Authentication, Reporting & Conformance (DMARC).

DKIM signs and verifies your email with [asymmetric encryption][asymm-encryption]. When you implement DKIM, your sending email server adds a cryptographic signature to your email message headers. Store your DKIM public key in a DNS TXT record.

The SPF email authentication standard allows you to list all IP addresses that can send email on behalf of your domain. Store the SPF IP address list in a DNS TXT record. The receiving email server compares the email sending server IP address to the IP address list stored in the SPF record.

To prevent harm to your sender reputation, the DMARC protocol verifies the email sending server. DMARC provides a policy to email service providers. This policy instructs providers how to act when they receive an email, apparently from your domain, that fails checks of SPF, DKIM, or both. Store your DMARC policy in a DNS TXT record.

Domain Authentication doesn't require DMARC. If Twilio SendGrid finds an existing DMARC policy at your domain, it displays. If Twilio SendGrid didn't find a DMARC policy, it returns the default policy: v=DMARC1; p=none.

During Domain Authentication setup, Twilio SendGrid turns on security by default.

• If you leave these security features turned on, Twilio SendGrid generates CNAME records to add to your domain.
• If you turn off security, Twilio SendGrid generates one MX record and two TXT records.

When Twilio SendGrid generates CNAME records during Domain Authentication, they map to a host in a domain that Twilio SendGrid controls. This means that Twilio SendGrid can create and update your SPF and DKIM records for you.

For example: If you purchase a dedicated IP address, Twilio SendGrid adds that IP address to your SPF record to your domain.

The CNAME record allows Twilio SendGrid to route click and open tracking statistics to your Twilio SendGrid account.

To support Link Branding through Domain Authentication, Twilio offers two additional CNAME records.

When you turn off Automated Security, Twilio SendGrid generates one MX record for you to add to your domain. This record enables the return-path.

The return-path email header defines an address separate from your original sending address. The return-path address tells email servers where to send feedback such as delayed bounces and unsubscribes.

To implement DKIM, SPF, and DMARC, use TXT records with specific formatting.

• With automated security turned off, Twilio SendGrid generates these TXT records to add to your domain.
• When you turn off automated security then make a change to your email configuration, update the TXT records on your domain.

For example: When you add an IP address to your account, update your SPF TXT record with the IP address to prevent email delivery issues.

Twilio SendGrid added a DMARC record on the DNS records page in the console. Completing this tutorial provides the data your organization needs to meet the inbox provider DMARC requirements. These inbox providers may block email that doesn't contain a valid DMARC record.

When sending email, set DNS records on the domain that make the following assertions:

1. Communicate to receiving email servers that you own the domain the email was sent from.
2. Verify that you have given the sending email server permission to send email on behalf of the domain.

Twilio SendGrid process for domain setup and setting the DNS entries includes Domain Authentication. After configuring Domain Authentication, you have the following benefits:

• You can remove via sendgrid.net (or via eu.sendgrid.net for Regional customers) beside the from address in your messages.
• You can improve the trust the legitimacy of your messages for both receiving email servers and human recipients. This improves your probability of reaching an inbox instead of a spam folder.

Configuring Domain Authentication requires changes to your DNS records. To change your DNS records, you need to determine two concerns:

1. Identify your domain provider.
2. Verify who can change DNS records with your provider.

To set up Domain Authentication, choose from three options:

1. Automated Setup: Have Twilio SendGrid configure it for you. Twilio SendGrid supports Domain Connect with GoDaddy. Log in to GoDaddy and give Twilio SendGrid permission to configure your DNS changes.

   (information)

   Conditions for automated setup

   Twilio SendGrid only supports automated setup with three conditions:

   • GoDaddy hosts the domains.
   • You left automated security turned on.
   • You're not using Link Branding.

2. Manual Setup: Configure the changes yourself.

3. Send To A Coworker: Send an email to a coworker with access to the DNS host so they can make the changes.

During Domain Authentication setup, on the second Authenticate Your Domain page includes a drop-down menu labeled Advanced Settings. The following section explains each of these settings.

Automated security differs from automatic setup. Automated security lets Twilio SendGrid manage the signing of your DKIM and the authentication of your SPF with CNAME records. This allows you to add a dedicated IP address or update your account without having to update your DNS records.

Automated security defaults to On. If your DNS provider doesn't accept underscores in CNAME records, turn off Automated Security then use MX and TXT records.

If you turn off automated security, you need to manage and update the MX and TXT records yourself.

To learn more about how this works, see [Twilio SendGrid DNS records][].

To customize the subdomain, use a custom return-path. This return-path informs receiving email servers where to route delayed bounces and unsubscribes.

To build a custom return-path,

1. Select Use a custom return path.
2. Type the letters or numbers.

If you don't select these, Twilio SendGrid selects them for you. Verify that your selected characters differ from those that Twilio SendGrid assigned you.

You might set a custom DKIM selector for one of two reasons:

1. You want to authenticate a single domain multiple times.
2. Another service uses the Twilio SendGrid DKIM selector, s.

To set a custom DKIM selector, add the custom selector to the domain as a custom subdomain.

1. Select Use a custom DKIM selector.
2. Type three letters or numbers to build a custom subdomain.
   • If you don't select these, Twilio SendGrid selects them for you.
   • Type three characters different from your original selection. For example: you could use org or 001.

Any domains authenticated before 2015 can't be updated or changed. To change or update it, delete the domain and recreate it as an authenticated domain.

• Troubleshooting Sender Authentication
• How to set up link branding
• How to set up reverse DNS
• Configuring Sign in with Apple