SendGrid SPF record

SendGrid can be authorized either with a root include or — far better — with a custom Return-Path (bounce) subdomain configured in its Sender Authentication settings.

The SPF include for SendGrid

Authorize SendGrid by adding its mechanism to your single SPF TXT record:

v=spf1 include:sendgrid.net ~all

Approximate lookup cost: 1 DNS lookup(s). Remember you have a budget of 10 total across every sender in the record.

Provider include values change occasionally. Confirm the current value in your SendGrid admin console before publishing, and never create a second v=spf1 record — a domain may have only one. Combine all senders into one record:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all

Best practice: use SendGrid’s branded/authenticated sending. When SendGrid sends with a Return-Path on a subdomain you delegate to it, SPF is validated on that subdomain and never touches your root domain’s 10-lookup budget at all. This subdomain trick is one of the cleanest ways to add a sender for free.

When adding SendGrid pushes you over the limit

Every include you stack — your mailbox provider, this one, a marketing tool, a help desk — adds to the same 10-lookup budget. The moment recursive expansion crosses 10, receivers return permerror and your SPF stops passing. You cannot shrink the nested provider records, so the durable fix is to flatten the record or move to a single-lookup macro that stays in sync automatically.