SendGrid dedicated IPs, authentication and reputation

23 June 2026 · 5 min read

A SendGrid dedicated IP sends only your mail, so its reputation is built entirely from your own volume, bounces and complaints. That helps a sender with steady, substantial volume and hurts one without, because a little-used IP never builds a reputation. Whichever IP you use, DMARC depends on SendGrid domain authentication: it makes SendGrid sign with your domain and use a return path on your domain, so your mail aligns.

What a dedicated IP changes

On SendGrid's shared IPs, your reputation is mixed with other senders'. Twilio's dedicated IP documentation notes that shared IPs can change without notice and that other senders' behaviour can affect your reputation. A dedicated IP removes that dependency, and adds a responsibility: you now have to keep the IP warm with consistent sending.

A dedicated IP does not change how SPF, DKIM or DMARC work. Alignment depends on domains, not IP addresses, so a dedicated IP neither fixes nor causes DMARC failures.

When a dedicated IP makes sense

From Twilio's documentation:

• The Pro Email API plan and the Advanced Marketing Campaigns plan each include one dedicated IP. Trial and Essentials accounts send from shared IPs.
• At 250,000 messages a month, Twilio recommends at least two dedicated IPs, one for marketing and one for transactional mail.
• To preserve reputation at high volume, it suggests one dedicated IP for every three to four million messages sent per day.

Twilio does not publish a single threshold below which a dedicated IP is a bad idea. The principle is that an IP needs regular volume for mailbox providers to judge it. If you send in occasional bursts, the shared pool is usually the safer choice.

Separating streams is a good reason on its own. Transactional mail such as password resets and receipts has high engagement and few complaints; marketing mail has more complaints. Keeping them on separate IPs, and ideally separate subdomains, stops one from affecting the other.

Warming up a new IP

A new IP has no reputation, and a sudden large volume from it looks suspicious to mailbox providers. Twilio's warm-up guidance covers the main points:

• Automated warm-up limits how much mail SendGrid sends through the new IP each hour and raises the limit on a schedule that runs to day 41, after which the IP leaves automated warm-up.
• Automated warm-up needs somewhere for the overflow to go: other IPs with capacity. Without them, Twilio retries the excess for 72 hours.
• Re-warm after a gap. If you have not sent through an IP for more than 30 days, warm it up again.
• Marketing senders should follow some form of warm-up. Transactional senders cannot control when mail is triggered, so a strict schedule does not suit them.

Practical habits during the ramp:

• Start with recipients who have opened or clicked recently, so early mail is wanted mail.
• Grow volume steadily rather than in spikes.
• Slow down if deferrals, bounces or complaints rise. Google asks senders to keep the spam rate below 0.1% and never reach 0.3%; Google Postmaster Tools shows yours.

Reverse DNS for the dedicated IP

Twilio recommends setting up reverse DNS for a dedicated IP: you add an A record that links the IP to your domain, so the IP's PTR name points to a hostname under your domain. Twilio's guide says the domain should match the domain of your From address, and that each IP can have only one reverse DNS setting. Gmail requires valid forward and reverse DNS for all senders, so this is worth doing first.

Domain authentication: the part DMARC depends on

SendGrid domain authentication asks you to publish CNAME records under your domain:

em1234.example.com          CNAME  u1234567.wl123.sendgrid.net
s1._domainkey.example.com   CNAME  s1.domainkey.u1234567.wl123.sendgrid.net
s2._domainkey.example.com   CNAME  s2.domainkey.u1234567.wl123.sendgrid.net

The hosts and targets above are placeholders; copy the exact values from your SendGrid account. Once they verify:

• DKIM is signed with d=example.com using the s1 or s2 selector, so it aligns with a From address on example.com.
• The return path moves to the em subdomain of your domain, so SPF is checked against your subdomain and, under relaxed alignment, aligns with example.com.

Without domain authentication, SendGrid's own domain appears in both places, SPF and DKIM pass for SendGrid, and DMARC fails for your domain. Why DMARC fails when SPF and DKIM pass explains the pattern.

Two checks after setup:

1. Send a test message and read the Authentication-Results header: you want dkim=pass with header.d= on your domain, and dmarc=pass.
2. Confirm the selectors resolve with the DKIM checker, and that your SPF record stays under ten DNS lookups with the SPF checker.

Use a subdomain for SendGrid

Sending from a subdomain such as mail.example.com or news.example.com keeps SendGrid's reputation, and its DMARC policy, separate from your main domain. A DMARC record on the subdomain overrides the parent's, so you can watch the new stream at p=none while the parent stays enforced. Authenticate the subdomain itself in SendGrid, and use it in your From addresses.

Order of work

1. Authenticate first. Domain authentication and reverse DNS before any volume, so every warm-up message carries your domain.
2. Warm second. Ramp the IP with engaged recipients.
3. Enforce third. Once your DMARC reports show SendGrid passing with alignment, move the policy to p=quarantine and then p=reject. The current DMARC standard, RFC 9989, removed the old pct= tag; use t=y for a trial step.

Common failures

• A dedicated IP with too little volume. The reputation never builds. Shared IPs may serve you better.
• Skipping domain authentication. SPF and DKIM pass for SendGrid and DMARC fails for you.
• A From domain that differs from the authenticated domain. Authenticate the domain you actually send from.
• DNS clean-ups that remove the em or s1/s2 CNAMEs. DKIM stops aligning overnight. Keep a record of what each entry is for.
• A long gap without sending. Re-warm after 30 days of inactivity.

The DMARC report analyser shows whether SendGrid's sources align in your reports. If you want that tracked over time, with alerts when a source stops aligning, DMARC analytics does it across every sender, and dedicated versus shared sending IPs covers the choice in general terms.