SendGrid is a capable transactional provider with a setup decision that catches out a large share of WordPress users. It offers two routes to proving you are allowed to send, they are presented as near-equivalent, and one of them leaves you failing DMARC without any warning.
The two routes
Single Sender Verification — you enter one email address, click a link in a confirmation message, and you can send. No DNS access required, no waiting. Two minutes.
Domain Authentication — you publish CNAME records at your DNS host so SendGrid can sign mail in your domain’s name. Ten minutes if you have DNS access, longer if you have to ask somebody.
Naturally, most people take the first one. It works: mail sends and arrives.
Why the quick route is a problem
Single Sender Verification proves to SendGrid that you control an address. It publishes nothing in your DNS, which means it does not produce the DKIM signature receiving servers use to verify your mail.
The consequence is specific. Your mail goes out signed by SendGrid’s domain rather than yours, so from a receiver’s point of view:
- DKIM may pass — but for
sendgrid.net, not for your domain. - SPF may pass — again, for SendGrid’s sending domain.
- DMARC fails, because DMARC requires authentication to pass for the domain in the From address the reader actually sees. This is alignment, and it is the part that catches people.
So you can pass SPF, pass DKIM, and fail DMARC — with a setup SendGrid told you was verified. If your domain publishes a DMARC policy of quarantine or reject, your own mail is the casualty.
SendGrid’s own documentation recommends Single Sender for testing rather than production. That recommendation is easy to miss, and the interface does not make the consequence obvious.
Use Domain Authentication
Publish the CNAME records SendGrid gives you, at the DNS host your nameservers point to — not necessarily your registrar. A domain registered in one place, with DNS served in another, is extremely common, and records added at the registrar do nothing.
Watch for a panel that appends your domain automatically. Entering a full hostname then produces something like s1._domainkey.example.com.example.com, which resolves to nothing.
The error messages, decoded
“The from address does not match a verified Sender Identity” — the From address your site is sending with is not one SendGrid recognises. Usually a WordPress plugin is overriding your configured From address; check what is actually being sent rather than what you configured. If you used Single Sender, only that exact address works; domain authentication allows any address on the domain.
“Sender Not Verified” — same cause, different wording.
“Error 450 – Sender Address Rejected: Domain Not Found” — the domain in your From address does not resolve. Typically a typo, or a domain that has expired.
Credentials rejected — with SMTP, the username is the literal string apikey, not your account name or email address. The password is the API key. This is unusual enough that people assume it is a placeholder.
Dedicated IPs and shared pools
SendGrid offers a dedicated IP on higher plans, and it is frequently bought for the wrong reason.
A dedicated IP has no sending history. Receiving servers treat unknown IPs cautiously, so a low-volume sender on a fresh dedicated IP often sees worse delivery than on a shared pool, where the accumulated reputation of many senders works in your favour.
Dedicated IPs make sense above roughly tens of thousands of messages a month, sent consistently, where you have enough volume to establish and hold a reputation of your own. Below that, a shared pool is the better choice and costs nothing extra.
If you do take one, it needs warming: start low and increase volume over weeks. Sending a large batch from a cold IP is the fastest way to get filtered.
Transactional and marketing on one account
SendGrid is happy to send both, which is convenient and carries a risk worth understanding.
Marketing mail generates complaints — people mark newsletters as spam far more often than receipts. Those complaints attach to your sending reputation, and if both streams share a domain and IP, the marketing reputation degrades delivery of your password resets and order confirmations.
The fix is separation: send marketing from a subdomain such as news.yourshop.com with its own authentication, and keep transactional mail on your primary sending domain. The two then carry independent reputations, and a bad campaign cannot cost you a receipt.
API key scope
Create a key with Mail Send permission only. SendGrid offers full-access keys, and a website has no reason to hold one — a compromised site should not be able to read your account or change your settings.
The key is displayed once. In NimblyMail it is stored encrypted at rest rather than in plain text, or you can keep it out of the database entirely with a constant in wp-config.php, which also prevents a production database restored onto staging from carrying live credentials.
Verifying properly
Send a test, open it in Gmail, choose Show original, and read Authentication-Results. You want:
spf=pass dkim=pass dmarc=passIf DKIM passes but DMARC fails, you are on Single Sender Verification. That is exactly the failure this article is about, and switching to domain authentication fixes it.
A message arriving is not proof of correct setup. A message arriving with all three passing is.
After setup
Watch bounces and suppressions. SendGrid suppresses addresses that have hard-bounced or complained, and a suppressed test address produces failures while real customers receive mail normally — which wastes a lot of diagnostic time.
Because domain authentication depends on records living outside your site, it is worth re-checking on a schedule. NimblyMail’s weekly audit re-verifies SPF, DKIM, DMARC and connectivity, reading the expected selector from the mailer you configured, so records removed during an unrelated DNS change surface as an audit failure rather than as a customer complaint.