Connecting SendGrid

Optional. Your DMARC reports work fully without it.

In short

If you send email through SendGrid (Twilio SendGrid), you can give dmarcful a read-only SendGrid API key. We use it to recognize your SendGrid mail in your DMARC reports and to check that your SendGrid domain setup is complete. We can't send email or change anything in your SendGrid account.

Why it helps

DMARC reports list the IP addresses that sent email using your domain. Many SendGrid customers share the same sending IPs, so a report alone can only say “this came from SendGrid”. It can't tell whether that was you or someone else using SendGrid to pretend to be you.

With your key connected, dmarcful can:

• Label your traffic. If your SendGrid account has dedicated IP addresses, mail from them is shown as your SendGrid. Your own mail is easy to trust, and any other SendGrid traffic using your domain stands out.
• Check your setup. When SendGrid mail fails DMARC, the usual cause is an incomplete domain setup in SendGrid: a DNS record that's missing or not verified. We show each authenticated domain and whether its records are verified, so you know exactly what to fix.

Do I need it?

• You don't use SendGrid: no, skip it.
• You use SendGrid with dedicated IPs (common for higher-volume senders): yes, you get the most from it.
• You use SendGrid on shared IPs: it's still useful for the setup check. Your reports already show whether SendGrid mail passes or fails DMARC either way.

How to connect

1. Sign in to SendGrid and open Settings → API Keys.
2. Click Create API Key and give it a name, such as dmarcful.
3. Choose Restricted Access. Leave everything at No Access except:
   • IP Addresses: Read Access
   • Sender Authentication: Read Access
4. Click Create & View and copy the key. It starts with SG. and SendGrid only shows it once.
5. In dmarcful, open DMARC Reports, paste the key into the SendGrid card and click Connect.

Only have a key with more access? It will work, but we recommend a read-only key: we never need more than the two permissions above.

What we read, and what we don't

• We read: your sending IP addresses, and your authenticated domains with the status of their DNS records.
• We don't read: your email content, contacts, lists, recipients or statistics, and we can't send email as you.

Security and removal

• Your key is encrypted before it's stored and is never shown again, including to our staff in the dashboard.
• We refresh the information every 6 hours, or when you click Sync now.
• Click Disconnect at any time to delete the key. You can also delete the key in SendGrid, which stops our access immediately.
• The key is deleted automatically if you delete your account, or with the rest of your data 90 days after your subscription ends.

Troubleshooting

• “Partial access” or “API key lacks this permission”: the key is missing one of the two read permissions above. Edit the key in SendGrid to add it, then click Sync now.
• 0 dedicated IPs: normal if your account sends from SendGrid's shared IPs. The domain check still works.
• A domain shows “Not verified”: open Settings → Sender Authentication in SendGrid, then add or fix the DNS records it lists.

Questions? Email inquiry@dmarcful.com.