SendGrid deliverability: authentication, IP pools, suppressions

SendGrid's delivery figure is an acceptance figure: it tells you the receiving server answered 250, not that anyone saw the message. Everything useful about SendGrid deliverability comes from four places — Sender Authentication, IP addresses and pools, Suppressions, and the event data you have to capture deliberately.

Authenticate the domain, not the address

Single sender verification exists so you can send a test quickly. It is not authentication: your mail is still signed by SendGrid's domain, so DMARC cannot align with your From domain, and any domain publishing p=quarantine or p=reject risks having its own mail filtered.

Do this instead, under *Settings → Sender Authentication → Authenticate Your Domain*: pick the DNS host, choose a subdomain for the mail stream, and publish the CNAMEs SendGrid generates — two DKIM selectors plus a mail subdomain that becomes the return path. Copy the hostnames from that screen; they are account-specific and they change, so never reuse values from a tutorial.

Two more settings on the same page are worth deliberate choices:

• Automated security on means SendGrid manages the DKIM keys behind CNAMEs, which is the low-maintenance option. Off means you publish TXT keys and own the rotation.
• Link branding rewrites click-tracking links to your own subdomain instead of a shared SendGrid domain. If you use click tracking at all, brand it — a shared redirect domain is a reputation you do not control.

Then verify from the receiving side: send to a mailbox you own, open the raw source, and confirm dkim=pass with header.i=@yourdomain.com and dmarc=pass with header.from=yourdomain.com.

IPs and pools

By default you are on a shared pool that SendGrid maintains, which is the right choice for most senders. Dedicated IPs are available on higher plans and configured under *Settings → IP Addresses*, where you can also create IP pools and assign sending to them.

Use pools to separate streams, not customers' feelings about them: transactional mail on one pool, marketing on another, so a promotional complaint spike cannot delay password resets. Dedicated IPs also carry an automated warmup option that caps daily volume per IP on a built-in schedule — leave it on unless you are migrating an IP that is already warm elsewhere, and either way register the IP with Microsoft SNDS and the Junk Mail Reporting Program, because that feedback is only available to the IP's owner.

A dedicated IP is the wrong move if your volume is spiky. Reputation on an unused IP decays, and you will re-warm forever.

Read suppressions properly

*Suppressions* holds five separate lists, and conflating them causes bad decisions:

A rising Blocks count is the single clearest early warning in the SendGrid UI, and it is the one most teams never open.

Capture event data before you need it

The *Email Activity* feed is searchable but its retention depends on plan, and the investigation you want to run always concerns last month. Set up the event webhook on day one and store the events yourself: processed, delivered, deferred, bounce, blocked, spam report, unsubscribe. The reason field carries the receiver's actual SMTP string, which is where the diagnosis lives — a 421 throttle and a 550 5.7.1 policy block call for opposite responses.

If you run multiple clients or products, use subusers: each gets its own authentication, suppression lists and API keys, so you can attribute a problem instead of guessing.

Thresholds to run against

• Hard bounces under 2%, acting at 5%.
• Complaints under 0.05%, acting at 0.1%.
• Gmail user-reported spam rate under 0.1%, with 0.3% as the published bulk-sender limit.
• Deferral share flat; a rising week-over-week trend means hold volume.

What not to do

• Do not send cold prospecting lists through SendGrid. The acceptable-use expectation is consent-based recipients, and the bounce and complaint profile of cold data will trip account review.
• Do not mix transactional and marketing on one subdomain and one pool.
• Do not use unbranded click tracking on a new domain, or any click tracking on one-to-one outreach.
• Do not re-import blocked addresses after a list cleaning pass. Blocks are about you, not about them.
• Do not rely on open rates to judge a fix. Apple Mail Privacy Protection and image proxies inflate opens; use seed placement and replies.

MailPilot connects to SendGrid over SMTP, so warm-up traffic travels the same path and carries the same DKIM signature as your production mail. It checks SPF, DKIM and DMARC on the sending domain, measures real inbox placement per provider through its seed network, and tracks reputation per mailbox daily — the folder-level view that stops at 250 OK in every ESP dashboard.