SendGrid must sign with your domain’s DKIM key (not sendgrid.net) for DMARC alignment. In the SendGrid dashboard, go to Sender Authentication → Domain Authentication and add your sending domain. SendGrid gives you 3 CNAME records to publish (they set up DKIM under s1._domainkey.yourdomain.com and s2._domainkey.yourdomain.com). Once these are published and verified in SendGrid, outbound mail carries a DKIM signature aligned to your domain — DMARC passes. Test with the email authentication checker after sending yourself a test message.
All questions
How do I verify my SendGrid DMARC alignment?
Read the full guide
What Is DMARC?
DMARC is the enforcement layer of email authentication. SPF and DKIM do the checking — DMARC tells receiving servers what to do when they fail, and reports back to you who's sending email using your domain.