Email authentication for Brevo: SPF, DKIM and DMARC

22 June 2026 · 5 min read

Brevo (formerly Sendinblue) authenticates your domain with three DNS records: a Brevo code TXT record that proves you own the domain, DKIM, and a DMARC record. Brevo's own help centre says SPF is not required unless you send from a dedicated IP. On Brevo's shared IPs, your DMARC pass therefore depends on the DKIM signature, so DKIM is the record to get exactly right.

The Brevo records at a glance

Always copy values from your own Brevo account. Targets and keys are specific to your domain.

Step 1: add the domain in Brevo

In Brevo, open the account menu and go to Settings > Senders, Domains, IPs > Domains, then click Add a domain. Add the domain you actually send from: if your From address is news@news.example.com, add news.example.com. If you send from several domains or subdomains, add each one.

Brevo offers automatic authentication, where you sign in to your DNS provider from Brevo and it adds the records for you. If your domain already has a DMARC record, automatic setup asks whether to replace it with Brevo's. If you want to keep your own DMARC record, choose manual setup instead.

Step 2: publish the Brevo code

The Brevo code is a TXT record that proves you control the domain. Brevo's troubleshooting guide suggests the bare domain as the host first, then @ or an empty host field if your DNS provider expects that. It plays no part in SPF, DKIM or DMARC.

Step 3: publish DKIM, preferably as two CNAMEs

Brevo supports two forms of DKIM:

• Two CNAME records at brevo1._domainkey and brevo2._domainkey. The keys stay on Brevo's side, and this is the only way to get a 2048-bit key.
• One TXT record holding the public key. Brevo's help centre says this form uses a 1024-bit key by default.

Use the CNAME form if your account offers it. Brevo's troubleshooting guide explains how to switch from the TXT record to the two CNAMEs, and advises leaving your current DKIM record in place until the domain shows as authenticated.

When you add the records:

• Try the short host name first (brevo1._domainkey). If Brevo cannot find the record, your DNS provider may want the full name, brevo1._domainkey.example.com. If entering the full name produces brevo1._domainkey.example.com.example.com, go back to the short form.
• On Cloudflare, turn off the proxy for both DKIM records and turn off CNAME flattening. Brevo warns that flattening turns the record into a TXT record and DKIM authentication then fails.
• Publish both CNAMEs. A single one leaves authentication incomplete.

Once the records resolve, go back to Brevo and click Authenticate this email domain. Brevo says DNS changes can take up to 48 hours to show. You can check the key yourself with the DKIM checker using the selector brevo1.

Step 4: publish DMARC

Brevo asks for a DMARC record as part of authentication and gives this value:

v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com

If your domain already has a DMARC record, do not add a second one: two records at _dmarc invalidate both. Instead, add Brevo's address to the rua tag of your existing record, separated by a comma:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com,mailto:rua@dmarc.brevo.com

Fixing multiple DMARC records covers the merge in detail.

Step 5: SPF only for a dedicated IP

Brevo states that SPF and MX records are not required to authenticate a domain, and that it only provides them when you set up a dedicated IP. If you send from a dedicated IP, publish the SPF value Brevo gives you in your one SPF record, merged with any other senders, and check it with the SPF checker. A domain may only have one SPF record, and SPF fails with a permanent error after ten DNS lookups.

On the shared IPs, do not expect an SPF include to rescue DMARC. Brevo's DKIM signature, with your domain as d=, is what aligns with your From address.

Step 6: send from the domain you authenticated

Brevo's guidance on alignment is strict: the From address should use the exact domain you authenticated in Brevo. Its examples treat a From address on news.example.com as a mismatch when only example.com is authenticated in Brevo. If you send from a subdomain, authenticate that subdomain in Brevo too.

Step 7: from p=none to enforcement

Brevo only provides a p=none record. Moving beyond it is up to you, and it affects every service that sends as your domain, not just Brevo:

1. Leave p=none running and read the aggregate reports. Brevo traffic should show DKIM pass and aligned.
2. Make sure every other legitimate sender also passes with alignment.
3. Change the policy to p=quarantine, then to p=reject.

The current DMARC standard, RFC 9989, suggests at least a month at p=none and a similar period at p=quarantine. It removed the old pct= tag; to trial a stricter policy, add t=y, which asks receivers to apply one level less. The DMARC report analyser shows which sources align, and p=none vs quarantine vs reject explains each stage.

Brevo checklist

1. Domain added under Settings > Senders, Domains, IPs > Domains.
2. Brevo code TXT record published.
3. Both DKIM CNAMEs published, unproxied and not flattened.
4. One DMARC record containing a rua address.
5. SPF only if you use a dedicated IP.
6. From addresses on the exact domain you authenticated.

Check the live state of your records with the DMARC checker. For why DKIM carries the DMARC pass here, read DMARC alignment explained. If you would rather have the policy staged and the reports read for you, hosted DMARC does both.