SendGrid

Twilio SendGrid is one of the largest email platforms. It handles both transactional and marketing email, scales to very high volumes and offers an EU data residency option through EU subusers.

Choose SendGrid when you already use it (or Twilio), expect large volumes, or need its detailed event data and IP management. For small projects, SendGrid’s account review and free-plan changes can be a hurdle – Resend, Postmark or Mailgun may be quicker. See the services overview.

Prerequisites

A SendGrid account that passed SendGrid’s account review (new accounts are sometimes asked for more details before they may send).
A verified sender: Domain Authentication for your domain (recommended) or at least Single Sender Verification for the From address (Settings → Sender Authentication).
An API key with restricted access: Settings → API Keys → Create API Key → Restricted Access, then set Mail Send → Full Access and leave everything else at No Access. Frontmail checks on Test connection that the key has the mail.send scope.

Connect in Frontmail

Open Email services → Add service → SendGrid.
Fill in the fields:

Field	Where to find it	Example
API key	Settings → API Keys (shown only once when created)	`SG.aBcD….xYz`
Region	Global for normal accounts; EU subuser if the key belongs to an EU-pinned subuser	`Global (api.sendgrid.com)`
Event webhook verification key	Settings → Mail Settings → Event Webhook → Signed Event Webhook → Verification Key	`MFkwEwYHKoZIzj0CAQYI…`
Max emails per second	Optional; default 10/s	`10`

Click Verify & save – Frontmail reads the key’s scopes and fails with a clear message if Mail Send is missing.
The service is saved once the check passes. Credentials are encrypted with AWS KMS envelope encryption.

DNS: SPF, DKIM and DMARC

With automated security (the default in Domain Authentication) SendGrid asks for three CNAME records and manages SPF and DKIM for you:

em1234.example.com.             CNAME  u1234567.wl123.sendgrid.net.
s1._domainkey.example.com.      CNAME  s1.domainkey.u1234567.wl123.sendgrid.net.
s2._domainkey.example.com.      CNAME  s2.domainkey.u1234567.wl123.sendgrid.net.

_dmarc.example.com.             TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

em1234 is the return-path subdomain (the number differs per account); it carries SPF, so you do not need include:sendgrid.net in your root SPF record.
s1 / s2 are the two DKIM selectors SendGrid rotates between.
With automated security off you instead publish an MX + TXT (v=spf1 include:sendgrid.net ~all) on the subdomain and a DKIM TXT record yourself.
Optionally add Link Branding CNAMEs so tracked links use your domain instead of sendgrid.net.
Start DMARC at p=none and tighten it when reports are clean.

Regions

Region	API host	Notes
Global	`api.sendgrid.com`	default for all accounts
EU	`api.eu.sendgrid.com`	only for EU subusers – data is stored and processed in the EU

EU data residency is set up by creating a subuser pinned to the EU region (availability depends on your plan) and creating the API key under that subuser. A key from an EU subuser does not work against the global host and vice versa.

Sandbox & limits

Free plan: historically 100 emails/day; SendGrid has changed the free offer to a time-limited trial, so check your current plan.
Single Sender Verification only allows the one verified From address; use Domain Authentication for anything else.
SendGrid’s own suppression groups (bounces, blocks, spam reports, invalid emails) silently drop messages to suppressed addresses – the send call succeeds, and the Event Webhook reports dropped.
SendGrid also has a sandbox mode (mail_settings.sandbox_mode) that validates a request without sending; Frontmail does not use it.

Webhooks (delivery tracking)

Copy the webhook URL from the service page in Frontmail (copy button):
```
https://api.frontmail.dev/webhooks/providers/sendgrid/<token>
```
In SendGrid open Settings → Mail Settings → Event Webhook (newer UI: Create new webhook), paste the URL as Post URL and select the events:

SendGrid event	Frontmail event
Delivered	`delivered`
Bounced	`bounced` (hard) – added to the suppression list
Dropped	`bounced` (invalid/bounced address → hard, others soft)
Deferred	recorded on the message
Spam Reports	`complained` – added to the suppression list
Opened	`opened`
Clicked	`clicked`

Turn on Signed Event Webhook (Security features), copy the Verification Key (a public key) and paste it into the Frontmail field Event webhook verification key.
Use Test Integration in SendGrid to send a sample batch.

Signature verification: SendGrid signs each batch with ECDSA. Frontmail verifies the X-Twilio-Email-Event-Webhook-Signature over the timestamp and raw body using your public verification key, and rejects requests older than 15 minutes. Without the key, events are not verified and are ignored.

Frontmail sets an X-Frontmail-Message-Id header on every message to match events.

Common errors

auth – the service is broken (invalid or revoked key, missing Mail Send permission, unverified sender, 401/403). The service is marked unhealthy, the owner receives an email and a dashboard banner. The template’s fallback service is used if set; otherwise the credit is refunded and the message waits in the hold queue as held_service_error and goes out automatically after you fix the service (re-checked on save and by the daily health check).
permanent – this message can’t be sent (invalid recipient, 400/413 validation). Fallback service if configured, otherwise failed and refunded.
transient – 5xx, 429, timeouts. Retried with exponential backoff; after the last attempt failed and refunded.

SendGrid response	Class	What to do
`401` – The provided authorization grant is invalid, expired, or revoked	auth	Create a new API key and update the service.
`403` – access forbidden / key lacks `mail.send`	auth	Edit the key: Mail Send → Full Access.
`403` – The from address does not match a verified Sender Identity	auth	Authenticate the domain or verify the From address in Sender Authentication.
`401`/`403` from `api.eu.sendgrid.com` with a global key	auth	Switch Region to match where the key was created.
`400` – Does not contain a valid address (`personalizations.0.to.0.email`)	permanent	See invalid recipient.
`413` – Payload too large	permanent	Total message size exceeds 30 MB; reduce attachments.
`429` – Too many requests	transient	Rate limited – retried after `Retry-After`.
`500` / `503`, timeout	transient	SendGrid outage – Frontmail retries.

Checklist

Domain Authentication: em…, s1._domainkey, s2._domainkey CNAMEs verified
DMARC record published (p=none to start)
Restricted API key with only Mail Send
Correct Region (EU only for EU subusers)
Test connection passes
Event Webhook with Delivered, Bounced, Dropped, Spam Reports (+ Opened/Clicked)
Signed Event Webhook on, verification key copied into Frontmail