emailsecops
Menu
Guides

Brevo SPF, DKIM and DMARC setup

Authenticate the domain in Brevo: a brevo-code TXT, two DKIM CNAMEs (brevo1 and brevo2) and a DMARC record, with the exact values shown in Brevo's setup screen. DKIM aligns with your From domain; on shared IPs no SPF record is needed.

Marketing email platform · reviewed October 13, 2026 against Brevo's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Brevo account: copy it from Brevo's setup screen, which shows the exact record.

ForTypeHostValue
Domain verification TXT {domain} brevo-code:{code}Copy the exact Brevo code from Brevo's domain setup screen.
DKIM CNAME brevo1._domainkey.{domain} {DKIM 1 record value shown in Brevo}On Cloudflare, turn off the proxy and CNAME flattening, or Cloudflare serves a TXT and DKIM fails.
DKIM CNAME brevo2._domainkey.{domain} {DKIM 2 record value shown in Brevo}
Return pathBranded subdomain (new setup flow) optional CNAME {branded-subdomain}.{domain} {value shown in Brevo}For example mail.{domain}; it moves the return path onto your domain so SPF aligns, and is required with a dedicated IP.
DMARC TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Part of Brevo's authentication; Brevo suggests adding rua=mailto:[email protected] to a single DMARC record.

SPF

None on shared IPs: Brevo says SPF and MX records aren't required to authenticate a domain. Its own brevosend.com is the default return path, so SPF passes for Brevo and can't align with your From domain; a branded subdomain (new setup flow) or a dedicated IP moves the return path onto your domain, with the SPF record supplied by Brevo.

DKIM

Two CNAMEs, brevo1._domainkey and brevo2._domainkey, point to 2048-bit keys that Brevo rotates periodically without any action from you; Brevo shows their values in its setup screen. Older accounts may still have a single TXT key at mail._domainkey, 1024-bit by default.

DMARC alignment

DKIM: the brevo1 and brevo2 keys sign with the authenticated domain, and Brevo expects it to be the exact domain of your From address. SPF aligns only with a branded subdomain or a dedicated-IP subdomain; otherwise it passes for brevosend.com.

Common mistakes

  • Authenticate the exact domain you send from: Brevo says authenticating yourcompany.com and sending from news.yourcompany.com fails DKIM, and the sender domain is replaced with brevosend.com.
  • A single TXT key at mail._domainkey is the older setup; it keeps working, but Brevo asks you to add the two CNAMEs and keep the TXT until the domain shows as authenticated.
  • SPF isn't required for Brevo on shared IPs, so an include:spf.brevo.com, or the older include:spf.sendinblue.com, in your root SPF record is not needed for Brevo mail and can be removed.
  • On Cloudflare, turn off the proxy and CNAME flattening for the DKIM CNAMEs, or Cloudflare converts them to TXT and DKIM fails.
  • Without authentication, Brevo replaces the From address with a brevosend.com address (t-sender-sib.com for transactional email), and it always replaces free-mail addresses.
  • Don't change or delete the records after authenticating, or the domain falls back to Not authenticated.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Brevo

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: spf.brevo.com, spf.sendinblue.com
  • Default DKIM selectors: brevo1, brevo2
  • DKIM keys delegated (CNAME) to *.brevo.com, *.sendinblue.com

Questions

What SPF record does Brevo need?+
None on shared IPs: Brevo says SPF and MX records aren't required to authenticate a domain. Its own brevosend.com is the default return path, so SPF passes for Brevo and can't align with your From domain; a branded subdomain (new setup flow) or a dedicated IP moves the return path onto your domain, with the SPF record supplied by Brevo.
What are the DKIM records for Brevo?+
Two CNAMEs, brevo1._domainkey and brevo2._domainkey, point to 2048-bit keys that Brevo rotates periodically without any action from you; Brevo shows their values in its setup screen. Older accounts may still have a single TXT key at mail._domainkey, 1024-bit by default.
Does Brevo mail pass DMARC?+
DKIM: the brevo1 and brevo2 keys sign with the authenticated domain, and Brevo expects it to be the exact domain of your From address. SPF aligns only with a branded subdomain or a dedicated-IP subdomain; otherwise it passes for brevosend.com.
Do I need a separate DMARC record for Brevo?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources