[FIXED] How does Sendgrid's automated security works?

Issue

SendGrid's automated security automate SPF and DKIM by a CNAME record. It even allows to have our own SPF and DKIM records in place directly using Domain Registrar.

How do they do it without collusion with existing SPF and DKIM records in place of domain?

Solution

Why use Automated Security

By using CNAME records provided by Sendgrid, you delegate the ownership of Sendgrid-specific SPF and DKIM records. Whenever they need to make a change (update SPF whitelisted hostname or rotate DKIM keys), they can do it without you having to touch DNS on your end.

It's convenient.

Below is my understanding of how it works for both types of records.

DKIM

You can have multiple DKIM records (public keys) as long as they use different selectors (host names).

Ex. you may already have a DKIM record for Google Workspace (G Suite):

TXT google._domainkey.yourdomain.com "v=DKIM1; k=rsa; t=s; p=MIGM..."

When setting Sendgrid Automated Security, they will provide you with 2 CNAMEs for DKIM managed by them. E.g.

CNAME s1._domainkey.yourdomain.com s1.domainkey.uXXX.wlXXX.sendgrid.net.
CNAME s2._domainkey.yourdomain.com s2.domainkey.uXXX.wlXXX.sendgrid.net.

Selectors do not conflict with Google's and can co-exist.

If you make a DNS lookup of the CNAME you will see a proper DKIM public key:

TXT s1._domainkey.yourdomain.com "v=DKIM1; k=rsa; t=s; p=MIGM..."

SPF

You can have only one SPF TXT record per (sub)domain. Note such record can list multiple IPs/hostnames that are authenticated. With Sendgrid Automated Security, you create a CNAME for a subdomain that points to SG servers. SPF record is hosted under that subdomain.

Ex. you may already have a SPF record for Google Workspace:

TXT yourdomain.com "v=spf1 include:_spf.google.com ~all"

Sendgrid will provide you with a CNAME similar to this:

CNAME em0000.yourdomain.com u0000000.wX0X0.sendgrid.net.

It does not conflict with your existing SPF record.

If you make a DNS lookup on that CNAME you will find a SPF record:

TXT em0000.yourdomain.com "v=spf1 include:sendgrid.net ~all"

Answered By - Max Ivanov

Answer Checked By - Dawn Plyler (PHPFixing Volunteer)

Read More

[FIXED] How would SendGrid Automated Security handle SPF record?

Issue

I use SendGrid and I have 2 dedicated IPs... My website sends its emails using SendGrid.

At the same time I use G Suite and I personally send my emails using G Suite (Google Workspace)

I want to setup DKIM and SPF records. SendGrid documentation has an option called Automated Security:

Automated security allows SendGrid to handle the signing of your DKIM and authentication of your SPF for your outbound email with CNAME records. This allows you to add a dedicated IP address or update your account without having to update your SPF record.

and later on...

When Automated Security is On, SendGrid generates 3 different CNAME records. In a later step of setting up domain authentication, you give these records to your DNS provider, and then you verify that they upload correctly.

If you select Off, we generate 1 MX record and 2 TXT records. In a later step of setting up domain authentication, you give these records to your DNS provider, and then you verify that they upload correctly.

So When Automated Security is ON I won't need to add any SPF and DKIM record, instead I have added the 3 CNAME records that is required for Automated Security...

On the other hand I am also using G Suite and G Suite wants me to add DKIM and the following SPF record:

v=spf1 include:_spf.google.com ~all 

From what I understand, the above SPF record means that _spf.google.com is the only server that should be sending my emails...

So my question is: Is adding G Suite SPF record conflicting with SendGrid Automated Security? My SPF record is saying the My SendGrid's dedicated IPs are not allowed to send email?

Imagine Yahoo mail server receives an email from one of my dedicated IPs (SendGrid)... how would Yahoo know that I am using Automated Security and the SPF record is handled by SendGrid? Because If Yahoo checked the SPF record, the SPF record is telling it that only _spf.google.com is allowed to send my emails?

Solution

Just a note: Your question would probably do better at the Server Fault forum.

To answer you questions: No the SPF record where you list G Suite is not conflicting with your SendGrid setup.

What is important to understand is: SPF says absolutely nothing about who is allowed to send emails FROM your domain. SPF authenticates the Return-Path address instead, and you're creating a subdomain for the bounce messages (what the Return-Path header is used for) with the CNAME delegation records in "Automated Security".

So, basically, Sendgrid is asking you to create a sub domain for them, e.g. em123.yourdomain.com by means of CNAME record. You delegate that subdomain over to them, targeting your personal Sendgrid tenant zone in DNS, where they create an SPF record and MX record at the root of that zone. A typical email from Sendgrid will then look like this:

from: you@yourdomain.com, Return-Path: bounces@em123.yourdomain.com

Thus, the receiving server will check the SPF record at em123.yourdomain.com to see if your IPs are allowed.

The other two CNAMEs are for the DKIM selector records. They point to TXT records that Sendgrid manages and rotates periodically.

So why not have Sendgrid use their domain in the Return-Path and not bother with the CNAME setup at all? DMARC demands that your Return-Path domain aligns with your FROM domain, OR that the domain used in your DKIM signatures aligns with your FROM domain. Preferably both.

Answered By - Reinto

Answer Checked By - Robin (PHPFixing Admin)

Read More

[FIXED] How can I get the message-Id after sending an email in Sengrid?

Issue

I am using sendgrid with .net, when I send and email with the API the response contains an x-message-id, but I need the message-id that is different

Solution

As you mentioned, the response includes x-message-id. When you use the API to send messages, you can send multiple using a single API call and thus the x-message-id identifies multiple messages.

To get the individual messages and their ID's, you can retrieve messages using the API by filtering on that x-message-id:

var queryParams = JsonSerializer.Serialize(new
{
  query = $"msg_id LIKE '{messageId}%'",
  limit = 10
});

var response = await client.RequestAsync(
  method: SendGridClient.Method.GET,
  urlPath: "messages",
  queryParams: queryParams
);

Console.WriteLine(await response.Body.ReadAsStringAsync());

The JSON returned looks like this:

{
  "messages": [
    {
      "from_email": "some@email.address",
      "msg_id": "5QSczogTRHqFtiIkLxMtWA.filterdrecv-5645d9c87f-6r2ch-1-62847C63-2D.0",
      "subject": "Sending with Twilio SendGrid is Fun",
      "to_email": "some@email.address",
      "status": "delivered",
      "opens_count": 0,
      "clicks_count": 0,
      "last_event_time": "2022-05-18T05: 01: 05Z"
    },
    {
      "from_email": "some@email.address",
      "msg_id": "5QSczogTRHqFtiIkLxMtWA.filterdrecv-5645d9c87f-6r2ch-1-62847C63-2D.1",
      "subject": "Sending with Twilio SendGrid is Fun",
      "to_email": "some@email.address",
      "status": "delivered",
      "opens_count": 0,
      "clicks_count": 0,
      "last_event_time": "2022-05-18T05: 01: 05Z"
    },
        ...
  ]
}

Note 1: You must purchase additional email activity history to gain access to the Email Activity Feed API.

Note 2: To retrieve message via the Email Activity Feed API, your API key must have the email_activity.read permission.

---

I'm not sure what your use case is, but you can use the SendGrid Event Webhook to get information about your email delivery and more in real-time, which may be a better way to go.

Answered By - Swimburger

Answer Checked By - Marie Seifert (PHPFixing Admin)

Read More

[FIXED] How to create custom field definitions with Sendgrid (v3) in C#?

Issue

According to the V3 Sendgrid documentation, I can create custom definitions using their API: https://docs.sendgrid.com/api-reference/custom-fields/create-custom-field-definition

My code is as follows:

        public static async void addCustomDefinition(SendGridClient client)
        {
                var data = "{ 'name': 'test_name', 'field_type': 'Text' }";

                var response = await client.RequestAsync(
                    method: SendGridClient.Method.POST,
                    urlPath: "marketing/field_definitions", //"contactdb /custom_fields",
                    requestBody: data
                );

                Console.WriteLine(response.StatusCode);
                Console.WriteLine(response.Body.ReadAsStringAsync().Result);
                Console.WriteLine(response.Headers.ToString());

        }

However, I got the following output error message:

BadRequest {"errors":[{"field":"body","message":"invalid character '\'' looking for beginning of object key string"}]}

What am I doing incorrectly?

PS: I changed the urlPath parameter:

...from online guide: urlPath: "v3/marketing/field_definitions,

to this version: urlPath: "marketing/field_definitions",

this newer version works for me on other commands such as getting field definitions and creating contact list

Solution

As you correctly stated, passing in the urlPath prefixed with v3 doesn't work. This is because the SendGridClient will prepend it for you automatically. You can pass in the version named parameter to the constructor or use the Version property on SendGridClient to change the version that is prepended if needed. It currently defaults to "v3".

The other issue is that the data variable contains invalid JSON. In JSON single quotes are not allowed, and instead you have to use double quotes. You can escape double quotes in a single-line string using a backslash:

var data = "{\"name\": \"custom_field_name\", \"field_type\": \"Text\"}";

You can escape double quotes in multi-line strings by adding extra double quote:

var data = @"{
    ""name"": ""custom_field_name"",
    ""field_type"": ""Text""
}";

Alternatively, you can create .NET objects and serialize them to a valid JSON string using System.Text.Json, JSON.NET, or other JSON libraries.

With these changes, your code should look like this:

public static async void addCustomDefinition(SendGridClient client)
{
    var data = "{ \"name\": \"test_name\", \"field_type\": \"Text\" }";

    var response = await client.RequestAsync(
        method: SendGridClient.Method.POST,
        urlPath: "marketing/field_definitions",
        requestBody: data
    );

    Console.WriteLine(response.StatusCode);
    Console.WriteLine(response.Body.ReadAsStringAsync().Result);
    Console.WriteLine(response.Headers.ToString());
}

It looks like the SendGrid client library has undergone some changes that aren't reflected yet in the document you linked. This issue and the other issues in the doc will be fixed soon.

Let us know if this fixed your problem!

Answered By - Swimburger

Answer Checked By - David Marino (PHPFixing Volunteer)

Read More

[FIXED] smtp.sendgrid.net connection refused to connect on web server.... correctly working in localhost

Issue

I am using sendgrid to send mail in my laravel application . I successfully tested application on localhost its working fine with mail facility also. but as i deployed to web server its started showing error " Swift_TransportException Connection could not be established with host smtp.sendgrid.net [Connection refused #111] ". Thanks in advance. Image Showing Error php artisan config:clear ,cache:clear and config:cache i tried all .... but nothing works.

.env file

MAIL_HOST=smtp.sendgrid.net
MAIL_PORT=587
MAIL_USERNAME=USERNAME
MAIL_PASSWORD=PASSWORD
MAIL_ENCRYPTION=tls

config/mail.php

'host' => env('MAIL_HOST', 'smtp.sendgrid.net'),
'port' => env('MAIL_PORT', 587),
'from' => [
        'address' => env('MAIL_FROM_ADDRESS', 'email@email.com'),
        'name' => env('MAIL_FROM_NAME', 'From Name'),
    ],
'encryption' => env('MAIL_ENCRYPTION', 'tls'),
'username' => env('MAIL_USERNAME','USERNAME'),
'password' => env('MAIL_PASSWORD','PASSWORD'),
'sendmail' => '/usr/sbin/sendmail -bs',
'markdown' => [
        'theme' => 'default',

        'paths' => [
            resource_path('views/vendor/mail'),
        ],
    ],
'log_channel' => env('MAIL_LOG_CHANNEL'),

        'stream' => [
       'ssl' => [
          'allow_self_signed' => true,
          'verify_peer' => false,
          'verify_peer_name' => false,
       ],
    ],

Solution

I used ichikawa/laravel-sendgrid-driver for sending mails using sendgrid and its working fine for me. get it on GITHUB

Answered By - Manish

Read More

[FIXED] Set SendGrid category in Laravel's mail library

Issue

I'm sending an email in Laravel via SendGrid using the configuration suggested in SendGrid's docs.

Just to provide an example of how it looks now:

Mail::send('emails.demo', $data, function($message)
{
    $message->to('jane@example.com', 'Jane Doe')->subject('This is a demo!');
});

The email itself works fine, but I'd like to add a SendGrid category. I've accomplished this in past non-Laravel projects using the addCategory() method in this repo.

My question: Is there an easy way to add a SendGrid category just using the Laravel mail library, or does it make more sense to just use the SendGrid PHP library?

Solution

I would just use the library, even though it isn't that pretty.

Answered By - Daniel Payne

Read More