Your own SendGrid account

Grade school

You need: your own website name (domain), a work email address on it, and someone who can change your domain’s settings.

High school

• A branded business address to sign up with, e.g. owner@brand.example.
• Access to the company that runs your domain’s DNS (not always where you bought the domain).
• Administrator access to your storefront’s WordPress, or someone who has it.
• A SendGrid plan that fits your volume. SendGrid’s pricing is between you and SendGrid.

College

You’ll create the SendGrid account in your organization’s name, so billing, logs, suppressions and reputation stay with you. Confirm who controls the authoritative DNS zone by checking the domain’s current nameservers, and make sure WP Mail SMTP is installed (the SendGrid mailer is in the free plugin).

Postgraduate

Establish ownership and control boundaries first: the account owner, the DNS change approver and the WordPress administrator may be different people. Record who holds each, because domain authentication, credential issuance and runtime configuration are separate changes with separate rollback paths.

Developer

Prerequisites: SendGrid account with 2FA; DNS write access on the authoritative zone; WP Mail SMTP ≥ 4.x active; outbound HTTPS to api.sendgrid.com permitted. EU-region accounts use api.eu.sendgrid.com, which the WP Mail SMTP SendGrid mailer doesn’t target, so use a global-region account with it.

Grade school

SendGrid gives you three special notes. You add them to your domain’s settings. Then SendGrid checks them.

High school

In SendGrid, go to Settings → Sender Authentication → Authenticate Your Domain, choose your DNS host and enter your domain. Leave automated security on.

SendGrid shows three CNAME records made just for your account and domain. Add them at your DNS host, then press Verify. It can take up to 48 hours.

College

With automated security, SendGrid delegates the return-path subdomain and two DKIM selectors by CNAME, so it can rotate keys and handle SPF without you editing your root SPF record. Some DNS hosts append the domain automatically — enter just em[NNNN] if yours does. On Cloudflare, set these records to DNS only.

Postgraduate

The CNAME model places key custody and SPF maintenance with the provider while keeping authority over delegation with you: deleting a CNAME revokes it. Link branding is optional and separate. Verify that DNS answers match on every authoritative nameserver before asking SendGrid to validate, and keep DNS readback, provider validation and message-level authentication as separate evidence.

Developer

Automated security on: em[NNNN] CNAME [uNNNN].[wlNNN].sendgrid.net, s1._domainkey CNAME s1.domainkey.[uNNNN].[wlNNN].sendgrid.net, s2._domainkey likewise (placeholders; use your account’s values). Off: MX + SPF TXT on em[NNNN] plus a DKIM TXT. dig CNAME s1._domainkey.brand.example @[each-authoritative-ns]. Source: SendGrid domain authentication.

Grade school

Make a secret key that can only send mail, nothing else. SendGrid shows it once, so put it straight into your website.

High school

Go to Settings → API Keys → Create API Key. Choose Restricted Access and turn on only Mail Send. SendGrid shows the key once — copy it straight into WP Mail SMTP (next step). Don’t email it, paste it into chat or save it in a document.

College

Restricted Access with Mail Send limits what a leaked key can do: it can send but can’t read contacts, change settings or create other keys. The key isn’t tied to one domain, so keep it only in the site that needs it. SendGrid accounts can hold up to 100 API keys.

Postgraduate

Least privilege bounds a compromise to abuse of your sending reputation, not account takeover. Because the key isn’t scoped to a domain or environment, isolation comes from where you install it and from separate keys per site or environment if you need independent revocation. Name keys descriptively in your own account so rotation is traceable.

Developer

API key permissions: mail.send only. The value is displayed once at creation (API keys). Transport header: Authorization: Bearer [key], never in a URL. Don’t log request bodies or full error payloads.

Grade school

In your website’s settings, pick SendGrid, paste the key, and type the name and email your customers should see.

High school

1. In WordPress, open WP Mail SMTP → Settings.
2. Set From Email to your branded sender (e.g. orders@brand.example) and tick Force From Email.
3. Set From Name (e.g. Brand Example) and tick Force From Name.
4. Choose the SendGrid mailer and paste your key into API Key.
5. Optional: enter your authenticated domain in Sending Domain so the plugin can spot DNS problems.
6. Save.

College

The SendGrid mailer uses SendGrid’s web API over HTTPS, not SMTP. Forcing the From address stops other plugins sending as unauthenticated addresses. Set Reply-To separately in WooCommerce so replies reach a monitored mailbox. After saving, the plugin masks the stored key.

Postgraduate

Where the site is managed by several people, keep the credential out of the admin database by using constants in wp-config.php, deployed through your own secret handling. That separates who can change email settings from who can read the key.

Developer

Constants alternative (WP Mail SMTP constants): enable with WPMS_ON, set WPMS_MAILER to sendgrid, and set the SendGrid API key constant from your environment, not a literal in version control. Allow api.sendgrid.com in any WP_ACCESSIBLE_HOSTS list if WP_HTTP_BLOCK_EXTERNAL is on.

Grade school

Send a test email to yourself. Check it arrived and looks right. Reply to it and make sure the reply reaches you.

High school

Use WP Mail SMTP → Tools → Email Test to send to your own branded address. Then place a test order on a test copy of your site to check real order emails. In SendGrid’s Activity view you can see whether each message was delivered, bounced or blocked.

College

In the received message, view the original source and check Authentication-Results for SPF, DKIM and DMARC passing for your domain. The plugin test confirms transport; it doesn’t prove WooCommerce templates, Reply-To or every notification type.

Postgraduate

Accepted (HTTP 202), delivered, authenticated, rendered correctly and replied-to are five different facts. Record each for the environment you’re testing, and don’t infer production readiness from a single plugin test.

Developer

Expect dkim=pass header.d=brand.example, spf=pass smtp.mailfrom=em[NNNN].brand.example, dmarc=pass. Correlate with the SendGrid message ID in Activity or Event Webhook data.