How to Whitelist a SendGrid IP Address for Reliable Email Delivery

Why You Need to Whitelist SendGrid IPs

Email infrastructure changes constantly, and receiving mail servers often flag unfamiliar sending IPs as suspicious. When a cloud email provider like SendGrid rotates IPs or when you move to a dedicated IP, your messages can land in spam or get rejected outright unless the IP is explicitly trusted. Whitelisting a SendGrid IP address tells spam filters, firewalls, and email gateways to accept mail from that sender without applying extra scrutiny. It is one of the most effective steps you can take to improve inbox placement and reduce bounce rates, especially for transactional or marketing flows that depend on consistent delivery.

Where Whitelisting Matters Most

You may need to whitelist SendGrid IPs in several places depending on your infrastructure:

• Corporate spam filters and email gateways (e.g., Microsoft Exchange, Proofpoint, Mimecast).
• Cloud firewalls or WAFs that block outbound SMTP traffic on port 25 or 587.
• Receiving mail servers that enforce IP-based allowlists.
• Cloud platforms like AWS, GCP, or Azure if egress rules restrict SMTP traffic.
• On-premises appliances such as Barracuda, Fortinet, or Cisco email security modules.

Finding the Correct SendGrid IP Addresses

SendGrid publishes the IP addresses used by its shared and dedicated infrastructure. For shared IP pools, the list can change as SendGrid rotates senders, so relying on a static snapshot is risky. Dedicated IPs are fixed and assigned to your account. To find the current IPs, log in to the SendGrid dashboard, navigate to Settings and then IP Addresses, or consult the official SendGrid documentation for the latest IP ranges. You should also verify the IPs that actually send your mail by checking the message headers of a delivered email, looking for the Received or X-Originating-IP fields. Matching those headers against your allowlist ensures you whitelist the correct, active endpoints.

How to Whitelist SendGrid IPs in Common Systems

Spam Filters and Email Gateways

In most spam filtering consoles, you can add the SendGrid IPs to a sender or IP allowlist. Look for sections labeled IP Whitelist, Safe Senders, or Trusted IPs. Enter the IP address or CIDR range and set the action to Bypass Spam Filtering or Deliver to Inbox. Save the policy and test by sending a message to an address monitored by the same filter.

Cloud Firewalls and Security Groups

If your environment restricts outbound traffic, add rules to permit traffic from your SendGrid IPs to destination mail servers on port 25, 465, or 587. In AWS, this means updating an outbound security group; in GCP or Azure, you adjust the firewall rules accordingly. Restrict the rule to only the SendGrid IPs and the necessary ports to minimize exposure.

Receiving Mail Servers and Anti-Spam Appliances

On appliances such as Barracuda or Fortinet, navigate to the IP Reputation or Sender Whitelist section. Add each SendGrid IP with a high trust score. Some systems let you specify the IP as a trusted relay, which skips further reputation checks for mail originating from that address.

Best Practices for Maintaining a SendGrid IP Allowlist

Whitelisting is not a one-time task. SendGrid may add or retire IPs as it scales its infrastructure, and your dedicated IPs remain fixed only as long as you keep them assigned. Review the allowlist quarterly or whenever you notice a spike in bounces or spam complaints. Combine IP whitelisting with authentication records — SPF, DKIM, and DMARC — so that even if an IP is not on the allowlist, receiving servers can still verify your domain's legitimacy. Monitor bounce logs and spam reports to catch issues early, and keep a runbook that documents which SendGrid IPs are whitelisted where, so that troubleshooting during an outage is faster.