Brevo SPF and DKIM setup

What you are setting up

Brevo (formerly Sendinblue) sends your marketing and transactional mail. Authenticating your domain publishes a verification record plus DKIM, so Brevo signs each message with your domain and the signature aligns. On a standard shared IP, that is the whole job, there is no SPF record to add. Because of the 2023 rename, guides written for Sendinblue may show old hostnames, so use the records your Brevo account shows, not a stale Sendinblue guide.

Authenticate the domain

In Brevo, go to Settings > Senders, Domains, IPs > Domains, click Add a domain (or Authenticate next to a domain already listed), and choose manual authentication if you would rather edit DNS yourself. Brevo shows you a verification record, a DKIM record, and a DMARC record:

Type:  TXT     (ownership / verification)
Host:  @          (the root of your domain)
Value: brevo-code:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Type:  CNAME   (DKIM 1)
Host:  (copy the exact record name Brevo shows)
Value: (copy the exact target Brevo shows)

Type:  CNAME   (DKIM 2)
Host:  (copy the exact record name Brevo shows)
Value: (copy the exact target Brevo shows)

Copy the DKIM names and targets exactly; they are specific to your account. Brevo shows DKIM either as one TXT record (a 1024-bit key at a mail._domainkey host) or as two CNAME records, which is how you get a 2048-bit key that Brevo rotates between the two for you. Use the Copy buttons in your account for the record names rather than typing them. Brevo is also rolling out a combined domain setup that adds a branded subdomain CNAME (which aligns SPF) and offers NS delegation instead; if your account shows that flow, publish the records it lists.

Do you need an SPF record? Not on a shared IP.

On Brevo's standard shared IPs, SPF is not part of the setup, and Brevo provides an SPF (and MX) record only when you move to a dedicated IP. Adding include:spf.brevo.com on a shared IP does not help DMARC, because it covers Brevo's return-path domain rather than your from address, and it spends one of your ten SPF lookups. DKIM alignment is what carries DMARC here, so leave SPF alone unless you are on a dedicated IP.

Add DMARC

Brevo includes a DMARC record in the flow, a standard _dmarc TXT. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none to quarantine and reject once your reports are clean.

The Brevo gotchas

Send from the domain you authenticated. If your from address is not on an authenticated domain, Brevo signs the message with its own domain instead of yours, the DKIM signature does not align with your domain, and DMARC will not pass for you. Use a from address at the domain you set up.

Do not delete the records once it goes green. All of the records, including the brevo-code verification TXT, must stay in place for as long as you send through Brevo. The brevo-code record is not a one-time throwaway; Brevo warns that changing or deleting any of them can lead to delivery problems or your mail being marked as spam. And if your DNS is on Cloudflare, set the DKIM CNAMEs to DNS-only (not Proxied) and turn CNAME flattening off, or the DKIM check fails.

Confirm it worked

• Verify in Brevo. The Domains page shows the domain as authenticated once the records resolve.
• Send a test and read the headers. Send yourself a message, open the original, and confirm the DKIM signature shows d=yourdomain.com and dmarc=pass. Our header analyzer reads it in plain English.
• Watch the reports. Brevo should appear as an aligned, passing source in your DMARC aggregate reports. trustyourinbox labels it as a known sender, so mail that went out signed by Brevo's own domain is easy to spot.