Production checklist
SendGrid production checklist: 4 checks before launch
4 checks for running SendGrid in production: 2 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (2)
Authenticate your sending domain (SPF, DKIM)
Unauthenticated mail lands in spam and is easier to spoof.
Verify from the command line
The DKIM records resolve to SendGrid, and Settings → Sender Authentication shows the domain as verified.
dig +short CNAME s1._domainkey.<your-domain> dig +short CNAME s2._domainkey.<your-domain>
Use a restricted API key with Mail Send only
A leaked full-access key can read contacts, change settings and send as you.
How to verify
Settings → API Keys: the app’s key shows Restricted Access with only Mail Send.
Good to have (2)
Publish a DMARC record
Tells mailbox providers what to do with mail that fails SPF and DKIM, which cuts spoofing of your domain.
Verify from the command line
A DMARC record exists (start with p=none and a reporting address, then tighten).
dig +short TXT _dmarc.<your-domain>
Verify the signature on the Event Webhook
Otherwise anyone can post fake bounce or unsubscribe events to your endpoint.
Check the code
Signed Event Webhook is on in Mail Settings, and your handler verifies X-Twilio-Email-Event-Webhook-Signature and the timestamp with the public key before trusting events.
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.