Brevo: DKIM and SPF setup

Before you start

You can authenticate only a domain you own and control. Brevo's help pages do not name a user role or a plan that authentication needs.

Brevo is rolling out a new domain setup flow to some accounts. It adds an optional branded subdomain, which moves the bounce address to your own domain. If your Domains page looks different from the steps below, follow Brevo's article on the new flow.

Turn on DKIM

Brevo calls this domain authentication. It asks for three or four records: a TXT record called the Brevo code, which proves you own example.com, the DKIM record or records, and a DMARC record. Depending on your account, Brevo shows two DKIM CNAME records or one DKIM TXT record.

1. In Brevo, open the account menu and go to Settings > Senders, Domains, IPs > Domains.
2. Click Add a domain and enter example.com. If example.com is already listed, click Authenticate next to it.
3. Choose Authenticate the domain yourself to add the records by hand. Brevo also offers Authenticate the domain automatically, which signs in to your DNS host for you.
4. Copy each record's name and value from Brevo into your DNS host: the Brevo code, then DKIM 1 and DKIM 2, or the single DKIM TXT record.
5. Deal with the DMARC record as described below.
6. Click Authenticate this email domain at the bottom of the page.

About the DMARC record. A domain may have only one DMARC record. If example.com already has a DMARC record, it sends reports to your reporting address. Brevo's automatic setup asks whether to replace an existing DMARC record. To keep yours, use the manual setup and do not add Brevo's DMARC record. Brevo's FAQ also shows how to add Brevo's own address to the rua tag. If you do, keep your reporting address in the tag as well.

If Brevo says "The domain is not authenticated yet", try again later. Brevo says DNS changes can take up to 48 hours.

Sign with your own domain

Reports show Brevo mail signed by one of Brevo's domains, which does not align with example.com. Authenticate example.com as in Turn on DKIM. With the DKIM records under example.com, DKIM can align.

Use your own bounce domain

In Brevo's new setup flow, a branded subdomain moves tracking links, image links and the return path to a subdomain of example.com. Brevo says it enables full SPF alignment on your sending domain. It is optional on a shared IP and required on a dedicated IP.

1. Add example.com under Settings > Senders, Domains, IPs > Domains with Add a domain.
2. In the Branded subdomain field, enter a prefix that example.com does not use yet, such as send, mail or em.
3. Add the records Brevo shows. The Branded record is the CNAME that links the subdomain to Brevo for SPF and the return path.
4. Click Authenticate domain. The branding status reads Branded once Brevo finds the records.

If your account does not have the new flow yet, authenticate DKIM as in Turn on DKIM. DMARC needs only one of SPF and DKIM to align.

SPF

Brevo says SPF and MX records are not required to authenticate a domain. It provides them only when you set up a dedicated IP.

Check it worked

1. On the Domains page, example.com shows Authenticated, and Branded if you set up a branded subdomain.
2. Open a message you sent through Brevo, view its header, and look for dkim=pass with d=example.com.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Brevo. The DKIM table on Mailmoni's DNS tab lists Brevo's selector once a report includes it.

Keep the records in place while you send through Brevo. Brevo warns that changing or deleting them can cause delivery problems.

Brevo's pages: Authenticate your domain, Set up your domain in Brevo and FAQs about domain authentication.