Skip to content
inboxprobe

Checkers

Generators

Guides

Guides

SPF, DKIM and DMARC for Brevo

Brevo (formerly Sendinblue) needs three or four DNS records: a Brevo code to prove you own the domain, DKIM, and DMARC. You only need SPF with a dedicated IP.

The records

Depending on your account, Brevo shows three or four records. Brevo's advice is to always use the exact value shown in your account. Here's what each one is:

RecordTypeHostWhat it does
Brevo codeTXTyour root domain (@, or empty)Verifies that you own and control the domain. The value is unique to your account.
DKIM2 × CNAMEbrevo1._domainkey and brevo2._domainkeyLets Brevo sign your mail with your domain.
DKIM (older accounts)1 × TXTthe name Brevo shows (use Copy DKIM record name)Same job, with the key in your DNS.
DMARCTXT_dmarcTells receivers what to do when authentication fails, and where to send reports.

DKIM, record 1

Type
CNAME
Host / name
brevo1._domainkey
Value
<value shown in Brevo>

DKIM, record 2

Type
CNAME
Host / name
brevo2._domainkey
Value
<value shown in Brevo>

DMARC, as Brevo recommends

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected]

Some DNS hosts want the full name (brevo1._domainkey.yourdomain.com) instead of the short one. Brevo's troubleshooting page says to try the short form first and the full one if verification fails.

DMARC when you already have one

A domain can only have one DMARC record. Brevo's automatic setup asks before replacing an existing one; if you want to keep yours, authenticate manually and leave _dmarc alone. To get reports in both places, merge the addresses into one record:

Reports to Brevo and to you

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected], mailto:[email protected]

Brevo recommends starting at p=none, then moving to quarantine and reject. The DMARC generator builds each stage.

SPF: only with a dedicated IP

Brevo says the SPF and MX records aren't required to authenticate a domain and are only provided when you set up a dedicated IP. On Brevo's shared IPs, DMARC passes through DKIM. If you do have a dedicated IP, add the SPF value Brevo shows to your existing SPF record rather than creating a second one; the SPF generator can merge them.

Common problems

  • Cloudflare: turn the proxy off (DNS only) for both DKIM CNAMEs, and turn off CNAME flattening, or DKIM authentication fails.
  • Free-mail addresses (gmail.com, yahoo.com…) can't be authenticated. Send from your own domain.
  • Not authenticated yet? Brevo rewrites your sender to an address like [email protected].
  • Want a 2048-bit key? The single TXT DKIM record uses a 1024-bit key; Brevo says to switch to the two CNAME records for 2048-bit.

Questions

Do I need to add Brevo to my SPF record?

Not on Brevo's shared IPs: Brevo only gives you SPF and MX records when you set up a dedicated IP. DKIM is what makes DMARC pass for your domain.

What is the brevo-code TXT record?

Brevo uses it to verify that you own and control the domain. It's a separate TXT record at the root of your domain, next to any others (including SPF); don't merge it into your SPF record.

Which selector do I enter in the DKIM checker?

brevo1 (and brevo2) if Brevo gave you CNAME records. For the single TXT record, use the part of the record name before ._domainkey.

Should I keep [email protected] in my DMARC record?

Brevo recommends it, and says a rua tag helps you meet Gmail, Yahoo and Microsoft's requirements. You can list your own address too, separated by a comma, in the same record.

Sources

Last reviewed: