SendGrid 403 "from address does not match a verified Sender Identity" in CI

By Kaveh Alemi·Latchkey

SendGrid returns HTTP 403 with "The from address does not match a verified Sender Identity" when the from email (or its domain) has not completed Single Sender or Domain Authentication. The key is valid; the sender is not authorized.

What this error means

A SendGrid mail/send request authenticates but returns HTTP 403 naming the from field, and no email is delivered.

< HTTP/2 403
{"errors":[{"message":"The from address does not match a verified Sender Identity. Mail cannot be sent until this error is resolved.","field":"from","help":null}]}

Common causes

The sender email is not verified

Single Sender Verification was never completed for the exact from address used in CI.

The domain is not authenticated

Sending from any address on a domain requires Domain Authentication (DKIM/SPF) to be set up and verified.

How to fix it

Verify the sender or domain

1. For a single address, complete Single Sender Verification in SendGrid.
2. For a domain, complete Domain Authentication by adding the CNAME records.
3. Use a from that exactly matches a verified identity.

{"from":{"email":"ci@your-verified-domain.com"},
 "personalizations":[{"to":[{"email":"team@example.com"}]}],
 "subject":"CI build passed","content":[{"type":"text/plain","value":"ok"}]}

Keep the from address in a variable

Pin the verified sender as a workflow variable so it cannot drift from what is authorized.

env:
  MAIL_FROM: ${{ vars.MAIL_FROM }}

How to prevent it

• Complete Domain Authentication so any address on the domain can send.
• Use only verified from addresses in CI email steps.
• Store the verified sender as a variable to prevent typos.

Frequently asked questions

Related guides

References

• GitHub Actions documentation