Send email through your own SendGrid account

You will need a SendGrid (Twilio SendGrid) account and access to your domain's DNS.

SendGrid's own documentation: Sender authentication · API keys · Sign up

1. Authenticate your domain

Settings → Sender Authentication → Authenticate Your Domain.

Pick your DNS host from the list, and answer Yes to "Would you like to also brand the links for this domain?" — link branding rewrites tracked links to your own domain instead of sendgrid.net, and a client who hovers a link in your invoice should see your name.

Enter a subdomain such as mail.yourdomain.com when asked for the domain you send from.

2. Publish the CNAME records

SendGrid gives you three or five CNAME records. Add all of them.

⭐ SendGrid uses CNAMEs rather than TXT records on purpose, and it is genuinely better: the actual key values live at SendGrid, so they can rotate their signing keys without you having to touch your DNS again.

⚠️ If your DNS provider is Cloudflare, set these records to DNS only (grey cloud), not proxied. A proxied CNAME resolves to Cloudflare's addresses and SendGrid's check fails.

Press Verify in SendGrid. Allow up to an hour.

3. Create an API key

Settings → API Keys → Create API Key.

Choose Restricted Access and grant Mail Send → Full Access only. Nothing else.

⛔ Do not use a Full Access key. A Full Access key can read your contacts, change your account settings and create more keys; the only thing we need to do is send a message. If our copy of your key were ever exposed, the difference between those two keys is the difference between some unwanted email and a compromised account.

⚠️ The key is shown once. Copy it before you leave the page — SendGrid cannot show it to you again, only replace it.

4. Connect it in Zinn®

Open Email sending in your dashboard:

• Provider — SendGrid
• Send from this domain — mail.yourdomain.com (a domain, not an address)
• SendGrid API key — the key from step 3

SendGrid needs no other settings from you.

5. Send the test and enter the code

Press Send test message to an inbox on a different domain, read the code out of it, and enter it.

When it does not work

403 Forbidden — your API key does not have Mail Send permission. This is the commonest failure by a distance: a Restricted Access key created with no scopes ticked authenticates perfectly and is allowed to do nothing.

"The from address does not match a verified Sender Identity" — your domain authentication has not gone green yet, or the domain in Send from this domain is not the one you authenticated. SendGrid checks the exact domain: authenticating mail.yourdomain.com does not authorise sending from yourdomain.com.

Accepted but never delivered — look at Activity in SendGrid. A brand-new account is sometimes held for review for the first day or so, and the messages sit there rather than bouncing.

Your account was suspended after a few sends — SendGrid is strict about new accounts sending to addresses that bounce. Make sure your client list is clean before you switch over.