How do I set up SendGrid so its email passes DMARC?

What does SendGrid ask me to publish?

To configure your domain to support authentication, Twilio SendGrid generates four DNS resource records.

SendGrid makes the values for your account, so we do not print any here.

Where in SendGrid are my values shown?

In the Twilio SendGrid console, select Settings > Sender Authentication

In SendGrid, go to Settings, then Sender Authentication. The records for your domain are shown on the Install DNS Records page.

Copy each value from there exactly as shown, and add each record at your DNS host.

Will p=reject block SendGrid email?

One TXT record that provides the DMARC record.

Not once SendGrid signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records SendGrid gives you are on your domain.

SendGrid lists a DMARC record among the records to publish for your domain.

SendGrid says subdomains do not inherit authentication from the parent domain, so each sending domain is authenticated on its own.

SendGrid also asks that your domain has a DMARC record. A domain has one DMARC record: if you have one, keep it and do not add another.

Before you raise your policy, read your DMARC reports and check that email from SendGrid passes.