You will need a SendGrid (Twilio SendGrid) account and access to your domain's DNS.
SendGrid's own documentation: Sender authentication · API keys · Sign up
1. Authenticate your domain
Settings → Sender Authentication → Authenticate Your Domain.
Pick your DNS host from the list, and answer Yes to "Would you like to also brand the links for this domain?" — link branding rewrites tracked links to your own domain instead of sendgrid.net, and a client who hovers a link in your invoice should see your name.
Enter a subdomain such as mail.yourdomain.com when asked for the domain you send from.
2. Publish the CNAME records
SendGrid gives you three or five CNAME records. Add all of them.
| Type | Host | Purpose | | --- | --- | --- | | CNAME | em1234.yourdomain.com | Return-path (bounce) domain | | CNAME | s1._domainkey.yourdomain.com | DKIM key 1 | | CNAME | s2._domainkey.yourdomain.com | DKIM key 2 |
⭐ SendGrid uses CNAMEs rather than TXT records on purpose, and it is genuinely better: the actual key values live at SendGrid, so they can rotate their signing keys without you having to touch your DNS again.
⚠️ If your DNS provider is Cloudflare, set these records to DNS only (grey cloud), not proxied. A proxied CNAME resolves to Cloudflare's addresses and SendGrid's check fails.
Press Verify in SendGrid. Allow up to an hour.
3. Create an API key
Settings → API Keys → Create API Key.
Choose Restricted Access and grant Mail Send → Full Access only. Nothing else.
⛔ Do not use a Full Access key. A Full Access key can read your contacts, change your account settings and create more keys; the only thing we need to do is send a message. If our copy of your key were ever exposed, the difference between those two keys is the difference between some unwanted email and a compromised account.
⚠️ The key is shown once. Copy it before you leave the page — SendGrid cannot show it to you again, only replace it.
4. Connect it in Zinn®
Open Email sending in your dashboard:
- Provider — SendGrid
- Send from this domain —
mail.yourdomain.com (a domain, not an address)
- SendGrid API key — the key from step 3
SendGrid needs no other settings from you.
5. Send the test and enter the code
Press Send test message to an inbox on a different domain, read the code out of it, and enter it.
When it does not work
403 Forbidden — your API key does not have Mail Send permission. This is the commonest failure by a distance: a Restricted Access key created with no scopes ticked authenticates perfectly and is allowed to do nothing.
"The from address does not match a verified Sender Identity" — your domain authentication has not gone green yet, or the domain in Send from this domain is not the one you authenticated. SendGrid checks the exact domain: authenticating mail.yourdomain.com does not authorise sending from yourdomain.com.
Accepted but never delivered — look at Activity in SendGrid. A brand-new account is sometimes held for review for the first day or so, and the messages sit there rather than bouncing.
Your account was suspended after a few sends — SendGrid is strict about new accounts sending to addresses that bounce. Make sure your client list is clean before you switch over.