SendGrid Deliverability:
IP Pools, Authentication, and What Event Webhooks Can't Tell You

SendGrid's Sending Architecture

SendGrid (now part of Twilio) is one of the most technically sophisticated email delivery platforms available. Unlike marketing-focused ESPs, SendGrid was built API-first — its primary interface is an HTTP API, and its architecture reflects the needs of developers building transactional email into applications, notification systems, and SaaS products.

At the core of SendGrid's deliverability architecture is the IP pool system. IP pools allow you to group dedicated IPs and route different types of email through different pools. A typical setup might have:

• A transactional pool for password resets, receipts, and notifications
• A marketing pool for bulk promotional campaigns
• A high-priority pool for critical security emails

This pool segmentation is a significant deliverability advantage. It ensures that a high-complaint marketing campaign cannot damage the IP reputation used by your transactional emails — the kind of infrastructure separation that's critical for SaaS companies where a forgotten-password email failing to reach a user is a real business problem.

SendGrid's shared IP pools (for accounts that haven't purchased dedicated IPs) are managed similarly to other ESPs: abuse monitoring, account suspension for high bounce/complaint rates, and active pool management. Dedicated IPs are available starting on Pro plans at approximately $30/month per IP.

What SendGrid Handles for Deliverability

SendGrid provides a substantial set of deliverability infrastructure out of the box — more technically configurable than marketing-focused ESPs, though requiring more setup effort.

Bounce and Complaint Processing

SendGrid processes bounce notifications automatically, classifying them as hard bounces (permanent failures) or soft bounces (temporary failures). Hard-bounced addresses are added to a global suppression list and never contacted again. Spam complaints received through feedback loops are processed similarly and result in automatic suppression.

Event Webhook

SendGrid's Event Webhook streams delivery events in real time to a URL you configure. Events include: delivered, bounce, spamreport, open, click, unsubscribe, deferred, and dropped. This gives engineering teams rich data for building custom dashboards, suppression logic, and deliverability alerting — but it requires development work to consume and act on.

Domain Authentication (Sender Authentication)

SendGrid calls their domain authentication system "Sender Authentication." Once configured, it adds DKIM signatures from your own domain to all outbound mail, replaces SendGrid's default click tracking domain (sendgrid.net) with your own domain via "Link Branding," and enables proper DMARC alignment.

IP Warmup Scheduler

For new dedicated IPs, SendGrid provides an automated warmup scheduler that gradually increases daily send volume on the new IP over a configurable schedule. This removes the manual work of managing the ramp-up process, though you still need to monitor domain reputation during warmup to catch any problems early.

Event Webhook Data: What It Shows and What It Misses

SendGrid's Event Webhook is one of its most powerful features for technical teams — and one of the most commonly misunderstood in terms of what it actually tells you about deliverability.

What "Delivered" Actually Means

The delivered event fires when the receiving mail server (Gmail's servers, Yahoo's servers, Outlook's servers) accepts the email message via SMTP. The receiving server returns a 250 OK response, SendGrid logs it as delivered, and the event fires.

Acceptance at the SMTP level does not mean the email reached the inbox. Gmail and other ISPs accept virtually all inbound mail at the SMTP level — the filtering decision happens internally afterward. An email can be "delivered" (accepted by Gmail's servers) and then placed directly in spam. From the SMTP handshake perspective, this is identical to a delivered email that goes to the inbox. SendGrid has no visibility into what happens after the 250 OK is returned.

What the Event Webhook Cannot Tell You

• Inbox vs. spam vs. promotions placement — The webhook fires "delivered" regardless of where the email lands
• Gmail domain reputation score — Requires direct access to Google Postmaster Tools
• Gmail user spam rate — How many Gmail users mark your mail as spam (different from FBL complaints)
• Yahoo complaint rate — Yahoo Sender Hub data isn't available via the webhook
• DMARC alignment failures — Whether ISPs are seeing alignment failures on your outbound mail
• Bot click separation — The click event fires for both real user clicks and security scanner auto-clicks

Authentication Setup in SendGrid

SendGrid's authentication setup is well-documented and relatively straightforward, but it has multiple components that all need to be configured correctly for optimal deliverability. Here's the complete setup:

Domain Authentication (DKIM + SPF)

1. In SendGrid, go to Settings → Sender Authentication → Authenticate Your Domain
2. Choose your DNS host and enter your sending domain (e.g., yourdomain.com)
3. SendGrid generates DNS records to add to your DNS: typically 3 CNAME records for DKIM and 1 CNAME for SPF (or a TXT SPF record depending on your setup)
4. Add the records to your DNS provider and click Verify in SendGrid once propagated
5. After verification, SendGrid signs all outbound mail with your domain's DKIM signature

Link Branding (Click Tracking Domain)

By default, SendGrid rewrites all links in your emails to use url5678.sendgrid.net or similar subdomains for click tracking. These rewritten links break DMARC alignment for links and create a noticeable discrepancy between your From domain and the URLs in your email. Link Branding replaces SendGrid's tracking domain with your own subdomain (e.g., click.yourdomain.com), which keeps all domains consistent and improves deliverability scores.

Publishing DMARC

After completing Domain Authentication and Link Branding, publish a DMARC record to enforce your authentication policy. Use InboxEagle's DMARC Record Generator to create the correct TXT record. Add it to your DNS as a TXT record for _dmarc.yourdomain.com. Monitor alignment via InboxEagle's DMARC monitoring before advancing beyond p=none.

Subuser Architecture and Reputation Isolation

SendGrid's subuser system is one of its most powerful features for organizations managing multiple sending identities — and it's a significant deliverability advantage when used correctly.

A SendGrid subuser is a child account within your main SendGrid account. Each subuser has its own:

• IP pool assignment (can be shared with other subusers or isolated)
• Sending domain and DKIM configuration
• Suppression list
• Statistics and reporting
• API keys

Use Cases for Subusers

Multi-brand organizations: If you operate multiple brands from one SendGrid account, each brand can have its own subuser with its own domain authentication, IP pool, and reputation. A deliverability problem on one brand won't affect the others.

Agencies managing client accounts: Each client gets their own subuser with isolated sending reputation. Client A's poor list hygiene cannot damage client B's deliverability.

Transactional vs. marketing separation: Route transactional email through a subuser with a dedicated IP pool isolated from marketing campaigns. Even if a marketing campaign generates elevated complaints, transactional emails continue delivering on the isolated pool.

What InboxEagle Adds to SendGrid Monitoring

SendGrid provides the best delivery event data of any mainstream ESP through its Event Webhook — but event data is not deliverability data. InboxEagle complements SendGrid by monitoring the inbox-level signals that the webhook cannot reach.

Inbox Placement Testing

InboxEagle's seed list tests send your actual campaigns to real email accounts at Gmail, Yahoo, Outlook, and other providers, then report where each message lands: inbox, spam, or promotions. This translates SendGrid's "delivered" events into actual placement data — the number that determines whether your recipients can see your mail.

Google Postmaster Tools Integration

InboxEagle's Postmaster integration surfaces your Gmail domain reputation, spam rate, authentication pass rates, and delivery errors — the signals that drive Gmail's inbox placement decisions. These are entirely separate from what SendGrid can observe and report.

Bot Click Filtering

Security scanners and email security gateways auto-click links in emails they scan for malware. These bot clicks appear in SendGrid's Event Webhook as real click events — and if you use click engagement for segmentation, you may be treating bot-engaged subscribers as highly engaged when they've never actually interacted with your email. InboxEagle's Bot Finder analyzes click patterns to separate bot clicks from human engagement.

DMARC Monitoring Across Subusers

InboxEagle's DMARC monitoring processes ISP aggregate reports for all your sending domains — including separate domains configured on different SendGrid subusers. This gives you a unified view of DMARC pass/fail rates across your entire sending infrastructure.