sendgrid remove via sendgrid.net

What does "via sendgrid.net" mean?

This is not an error — it is a transparency label that mailbox providers (most visibly Gmail) display when the message's authenticated domain does not match the visible From address. Because SendGrid signs unauthenticated mail with its own sendgrid.net domain (DKIM d= and the SPF-checked Return-Path / envelope sender), Gmail tells the recipient the mail was sent via SendGrid on your behalf, showing yourname@yourdomain.com via sendgrid.net.

Per SendGrid's documentation, EU/Regional customers see the variant via eu.sendgrid.net. The label appears whenever you send before completing Domain Authentication (formerly called "domain whitelabel" / "sender authentication"). It does not block delivery, but it looks unbranded and can reduce trust and deliverability.

How do I remove "via sendgrid.net"?

Remove it by completing Domain Authentication so your mail is DKIM-signed (RFC 6376) and SPF-aligned (RFC 7208) with your domain instead of sendgrid.net. The fastest path is the SendGrid UI:

1. In the SendGrid app, go to Settings → Sender Authentication.
2. Under Authenticate Your Domain, click Get Started.
3. Select your DNS host (e.g., GoDaddy, Cloudflare, Route 53) and choose whether to also brand links.
4. Enter your root domain (e.g., example.com). Leave Automated Security ON (recommended) so SendGrid rotates DKIM keys for you. Use Advanced Settings to set a custom return path, custom DKIM selector, or to make the domain EU‑pinned.
5. SendGrid generates the DNS records. With Automated Security ON you get 3 CNAME records — one for the mail subdomain (supports SPF/DKIM) and two DKIM selector records (s1._domainkey and s2._domainkey) — plus 1 TXT record for a DMARC policy. With Automated Security OFF you instead maintain an MX record and TXT records (SPF, DKIM, and DMARC) yourself. (Branding your click-tracking links is a separate, optional step that publishes its own additional CNAME records — see the Tip below.)
6. Add those records at your DNS host exactly as shown (host/name and value), then return to SendGrid and click Verify.

DNS changes typically propagate within a few hours, though it can occasionally take up to 48 hours. Once verified, new messages are signed with your domain and the "via sendgrid.net" tagline disappears. You generally must also update the From address to use the authenticated domain (or a subdomain of it) for alignment to take effect.

Doing it via the API instead

You can also create the authenticated domain through the Domain Authentication API and then publish the returned DNS records. The previous version of this page used a payload with "automatic_security": false — note that disabling automated security means you are responsible for maintaining and rotating DKIM keys. A minimal correct call with the official PHP library:

<?php
require 'vendor/autoload.php';

$apiKey = getenv('SENDGRID_API_KEY');
$sg = new \SendGrid($apiKey);

$request_body = json_decode('{
    "domain": "example.com",
    "subdomain": "em",
    "automatic_security": true,
    "default": true
}');

try {
    $response = $sg->client->whitelabel()->domains()->post($request_body);
    echo $response->statusCode() . "\n";
    // The response body contains a "dns" object with the CNAME records to publish
    // (mail_cname plus the dkim1 / dkim2 selector records).
    echo $response->body() . "\n";
} catch (Exception $e) {
    echo 'Caught exception: ' . $e->getMessage() . "\n";
}

After the POST returns the DNS records, publish them at your DNS host and then call the validate endpoint (or click Verify in the UI). The ips and custom_spf fields are only relevant for dedicated-IP/manual-SPF setups; omit them when using Automated Security.

Tip: removing sendgrid.net from click-tracking link URLs is a separate setting — Link Branding — toggled during the same Domain Authentication flow. Authenticating the domain handles the From-address tagline; link branding handles the URLs inside the email body.