sendgrid expected cname for to match

SendGrid returns "Expected CNAME for em1234.example.com to match u1234567.wl123.sendgrid.net" when you click Verify on a Domain Authentication (formerly "domain whitelabel") setup and the CNAME it queries either does not resolve or resolves to a value other than the target it generated for you. It is a DNS-side error, not an SMTP send error — your domain is simply not authenticated yet.

What causes "Expected CNAME for X to match Y"?

SendGrid's automated-security setup signs your DKIM and aligns your SPF using CNAME records that delegate to SendGrid-hosted DNS. When you save a domain, SendGrid generates records like these (per the SendGrid domain authentication docs):

HOST                          TYPE    POINTS TO
em1234.example.com            CNAME   u1234567.wl123.sendgrid.net
s1._domainkey.example.com     CNAME   s1.domainkey.u1234567.wl123.sendgrid.net
s2._domainkey.example.com     CNAME   s2.domainkey.u1234567.wl123.sendgrid.net

The validator does a live DNS lookup of the host on the left and checks that it is a CNAME pointing at the value on the right. The error fires when, per SendGrid's Troubleshooting Sender Authentication guide, one of these is true:

• The host is duplicated. Many DNS panels (GoDaddy, etc.) auto-append your domain, so entering em1234.example.com becomes em1234.example.com.example.com. The host SendGrid queries then doesn't exist.
• The target is wrong or truncated. A typo, an extra trailing dot, or the panel rewriting sendgrid.net value breaks the match.
• The record is proxied. A CNAME behind Cloudflare's orange-cloud proxy resolves to Cloudflare IPs (effectively an A record), not the sendgrid.net CNAME, so the match fails.
• A conflicting record exists. An existing MX, A, or TXT record on the same host blocks the CNAME (a host can have only one CNAME and no other record per RFC 1034 §3.6.2).
• DNS hasn't propagated yet. Changes can take up to 48 hours.
• Duplicate domain entries. Stale Pending/Failed authentication entries for the same domain in SendGrid confuse validation.

How do I fix "Expected CNAME for X to match Y"?

1. Copy the exact host and target from SendGrid. Settings → Sender Authentication → your domain → View DNS Records. Don't retype them.

2. Enter the host as a relative name if your DNS panel appends the domain. Use em1234, not em1234.example.com. SendGrid's GoDaddy guide gives the corrected form:

3. em1234 — Points to: u1234567.wl123.sendgrid.net
4. s1._domainkey — Points to: s1.domainkey.u1234567.wl123.sendgrid.net
5. s2._domainkey — Points to: s2.domainkey.u1234567.wl123.sendgrid.net

3. Verify with dig before re-validating. The output must show the exact sendgrid.net target:

   dig +short CNAME em1234.example.com
   # expected: u1234567.wl123.sendgrid.net.

4. Turn off proxying (Cloudflare: set the record to "DNS only" / grey cloud).
5. Remove conflicting records on the same host, and delete any Pending/Failed duplicate domain authentication entries in SendGrid.
6. Wait for propagation (up to 48 hours) and click Verify again. If dig returns the correct value but SendGrid still fails, contact SendGrid Support.

Note: this CNAME error is distinct from a lookup ... no such host failure on a _domainkey TXT record, which happens when manual DKIM is used and the key was split across multiple quoted strings — that is a different setup path and not what "Expected CNAME to match" refers to.