Knowledge base
Send email through your own SendGrid account
Connect your own SendGrid account: domain authentication and its CNAME records, a restricted Mail Send key rather than full access, the Cloudflare grey-cloud trap, and what a 403 on a valid key actually means.
You will need a SendGrid (Twilio SendGrid) account and access to your domain's DNS.
SendGrid's own documentation: Sender authentication · API keys · Sign up
1. Authenticate your domain
Settings → Sender Authentication → Authenticate Your Domain.
Pick your DNS host from the list, and answer Yes to "Would you like to also brand the links for this domain?" — link branding rewrites tracked links to your own domain instead of sendgrid.net, and a client who hovers a link in your invoice should see your name.
Enter a subdomain such as mail.yourdomain.com when asked for the domain you send from.
2. Publish the CNAME records
SendGrid gives you three or five CNAME records. Add all of them.
| Type | Host | Purpose | | --- | --- | --- | | CNAME | em1234.yourdomain.com | Return-path (bounce) domain | | CNAME | s1._domainkey.yourdomain.com | DKIM key 1 | | CNAME | s2._domainkey.yourdomain.com | DKIM key 2 |
⭐ SendGrid uses CNAMEs rather than TXT records on purpose, and it is genuinely better: the actual key values live at SendGrid, so they can rotate their signing keys without you having to touch your DNS again.
⚠️ If your DNS provider is Cloudflare, set these records to DNS only (grey cloud), not proxied. A proxied CNAME resolves to Cloudflare's addresses and SendGrid's check fails.
Press Verify in SendGrid. Allow up to an hour.
3. Create an API key
Settings → API Keys → Create API Key.
Choose Restricted Access and grant Mail Send → Full Access only. Nothing else.
⛔ Do not use a Full Access key. A Full Access key can read your contacts, change your account settings and create more keys; the only thing we need to do is send a message. If our copy of your key were ever exposed, the difference between those two keys is the difference between some unwanted email and a compromised account.
⚠️ The key is shown once. Copy it before you leave the page — SendGrid cannot show it to you again, only replace it.
4. Connect it in Zinn®
Open Email sending in your dashboard:
- Provider — SendGrid
- Send from this domain —
mail.yourdomain.com(a domain, not an address) - SendGrid API key — the key from step 3
SendGrid needs no other settings from you.
5. Send the test and enter the code
Press Send test message to an inbox on a different domain, read the code out of it, and enter it.
When it does not work
403 Forbidden — your API key does not have Mail Send permission. This is the commonest failure by a distance: a Restricted Access key created with no scopes ticked authenticates perfectly and is allowed to do nothing.
"The from address does not match a verified Sender Identity" — your domain authentication has not gone green yet, or the domain in Send from this domain is not the one you authenticated. SendGrid checks the exact domain: authenticating mail.yourdomain.com does not authorise sending from yourdomain.com.
Accepted but never delivered — look at Activity in SendGrid. A brand-new account is sometimes held for review for the first day or so, and the messages sit there rather than bouncing.
Your account was suspended after a few sends — SendGrid is strict about new accounts sending to addresses that bounce. Make sure your client list is clean before you switch over.
Still stuck?
Support is included on every plan and answers in your own language.
Contact support → All articles →