# How to set up SPF and DKIM for Brevo (formerly Sendinblue) > How to set up SPF and DKIM for Brevo: authenticate the sending domain, publish Brevo's account-generated DNS records, then validate a real message. To set up email authentication for Brevo, open **Settings > Senders, Domains, IPs > Domains**, add the domain used in your From address, then choose Brevo's automatic or manual authentication flow. Manual authentication displays account-generated Brevo code, DKIM, and DMARC DNS records. Do not add an SPF include unless Brevo's dedicated-IP configuration for your account explicitly supplies one. ## Quick takeaways - Brevo's documented domain-authentication flow starts at **Settings > Senders, Domains, IPs > Domains**. - Automatic authentication connects Brevo to a supported DNS provider, while manual authentication gives you records to publish yourself. - Brevo can display either one DKIM TXT record or two DKIM CNAME records for an account. - Copy every Brevo DNS value from the selected account and domain, not from an online example. - A domain must have one SPF TXT record, so merge mechanisms into an existing record instead of creating a second SPF record. - A vendor verification result does not prove that a real message passed DKIM or DMARC. ## What should I check before configuring Brevo? Confirm which mail stream Brevo sends. This guide applies to messages sent through Brevo, such as marketing campaigns or transactional mail configured in Brevo. It does not automatically authenticate employee mail sent through Microsoft 365, Google Workspace, or another mailbox provider. You need access to the Brevo account that owns the sender domain and permission to change its authoritative DNS zone. Confirm the visible From domain before adding records. A subdomain used for campaign mail can have a different DNS zone and authentication plan from the parent domain. Brevo's [domain authentication instructions](https://help.brevo.com/hc/en-us/articles/12163873383186-Authenticate-your-domain-with-Brevo-Brevo-code-DKIM-DMARC) document the current settings path and authentication options. The path was verified from official documentation. The DNS values displayed in the account are the configuration source for the selected domain. > Copy DNS values from the account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example. Also check for existing SPF and DMARC records before making a DNS change. Publishing a second SPF policy at the same domain can create an SPF PermError. Replacing an existing DMARC record can remove reporting destinations or weaken an established policy. ## Which setup method should I use? Use automatic authentication when the approved DNS provider account can be connected to Brevo and the domain has no existing records that require a manual review. Use manual authentication when DNS changes go through an IT approval process, DNS-as-code workflow, external administrator, or an existing DMARC policy that must remain intact. Choose the records Brevo presents for the selected domain. Brevo documents automatic and manual flows, plus the option to have another person authenticate the domain when they control DNS access. ![Brevo domain authentication dialog showing the flow for adding a domain](/images/editorial/how-do-i-set-up-spf-and-dkim-for-brevo/brevo-add-domain.jpg "2642x1054") *Source: [Authenticate your domain with Brevo: Brevo code, DKIM, DMARC](https://help.brevo.com/hc/en-us/articles/12163873383186-Authenticate-your-domain-with-Brevo-Brevo-code-DKIM-DMARC), checked 2026-08-10.* For a dedicated IP, stop at Brevo's account-specific setup instructions. Dedicated-IP routing can require a different DNS configuration, including SPF details supplied for that sending path. Do not assume that a shared-IP domain-authentication record set applies to dedicated IP mail. ## How do I configure SPF and DKIM for Brevo? ### 1. Open the Brevo domain settings In Brevo, open **Settings > Senders, Domains, IPs > Domains**. Select the domain already listed, or choose the option to add a domain. Enter the domain shown after `@` in the From address used by the Brevo campaign or transactional sender. Check the spelling and domain suffix before continuing. Authentication records for `mail.yourdomain.com` do not automatically apply to `yourdomain.com`. ### 2. Select the sending domain and authentication method Choose automatic authentication if Brevo can connect to the DNS provider account that is authorized to make the change. Review the records before approving the change, especially if the domain already has a DMARC policy. Choose manual authentication if you need to review the DNS change outside Brevo. Keep the Brevo page open so you can compare the host and value against the DNS record before saving. Brevo's manual flow can show a Brevo code record, DKIM records, and a DMARC record. Its documentation states that the DKIM configuration may appear as one TXT record or two CNAME records. The record format depends on the selected account and domain. ### 3. Publish the Brevo-generated DNS records Add the exact records shown by Brevo to the authoritative DNS zone. The following shapes are illustrative only. They are not Brevo configuration values and cannot authenticate mail. **Brevo code record:** `TXT` **Host:** Copy the host Brevo displays. **Value:** Copy the unique verification value Brevo displays. **DKIM record:** `TXT` or `CNAME`, as shown by Brevo. **Host:** Copy the generated selector host. **Value or target:** Copy the complete Brevo-generated value or target. ```text Illustrative only Brevo code Type: TXT Host: Value: DKIM Type: CNAME or TXT Host: ._domainkey.yourdomain.com Value: ``` > Do not publish this example. Generate and copy the real host, selector, target, and verification value from the Brevo account that sends your mail. Some DNS providers append `yourdomain.com` to the host field automatically. If Brevo displays a fully qualified host and the DNS provider also appends the zone, entering the complete host can create a duplicated name such as `selector._domainkey.yourdomain.com.yourdomain.com`. Check the final owner name in the DNS provider before saving. Do not overwrite an active DKIM selector without confirming its owner and rotation plan. [RFC 6376's DKIM key-record format](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1) uses a selector-specific DNS name, so the selector identifies which public key a receiver retrieves. ![Brevo domain authentication record area showing a DKIM record](/images/editorial/how-do-i-set-up-spf-and-dkim-for-brevo/brevo-dkim-record.jpg "1774x492") *Source: [Authenticate your domain with Brevo: Brevo code, DKIM, DMARC](https://help.brevo.com/hc/en-us/articles/12163873383186-Authenticate-your-domain-with-Brevo-Brevo-code-DKIM-DMARC), checked 2026-08-10.* ### 4. Handle SPF only when Brevo supplies an SPF requirement Brevo's standard domain-authentication flow should be followed as displayed in the account. Do not add `include:spf.brevo.com`, a legacy Sendinblue include, or another SPF mechanism based only on an example from a different account or setup. If Brevo's dedicated-IP setup gives you an SPF mechanism, inspect the existing SPF TXT record first. SPF evaluation uses one policy record for the domain. [RFC 7208](https://datatracker.ietf.org/doc/html/rfc7208#section-3.2) specifies that multiple SPF records cause a PermError. Merge only the mechanisms required by the actual senders into the existing SPF policy. Preserve its terminal qualifier unless the approved change specifically requires it. ```text Illustrative SPF structure only v=spf1 include: include: ~all ``` Do not publish the example as written. Use the exact mechanism Brevo provides, retain only valid mechanisms for your sending sources, and have the proposed merged record reviewed before replacing production DNS. ### 5. Verify in Brevo and send a real test message Return to the selected domain in Brevo and use its verification or authentication action after public DNS answers with the records you published. Record the domain, change time, DNS approver, and the Brevo status shown for the change record. Then send a new message through the exact Brevo sending path. Use a test mailbox where you can inspect the raw source. A vendor status can show that Brevo accepted DNS, but it cannot prove what a receiving mailbox evaluated for a delivered message. ## How does this setup affect DMARC? DKIM supports DMARC when the `d=` domain in the message's DKIM signature [aligns with the visible From domain](/learning/glossary/dmarc-adkim-aspf). [RFC 9989's DMARC alignment rules](https://datatracker.ietf.org/doc/html/rfc9989#section-3.1) explain that a DKIM pass for an unrelated domain does not satisfy DKIM alignment. SPF can also satisfy DMARC, but only when the authenticated SPF domain aligns with the visible From domain. Do not infer alignment from the presence of an SPF record alone. The delivered message is the evidence for the actual path. After publishing or changing DNS, use the [DMARC checker](/tools/dmarc) to inspect the public DMARC policy. A public check cannot prove Brevo's production return path, a receiver's private decision, or future inbox placement. For broader context, see Palisade's [email authentication learning center](/learning). ![Example DNS record relationships for Brevo domain authentication](/images/editorial/how-do-i-set-up-spf-and-dkim-for-brevo/how-do-i-set-up-spf-and-dkim-for-brevo-records.webp "1200x533") *Source: Palisade.* ## How do I validate the setup? ### Check public DNS [Look up the exact owner names](/tools/dns-lookup) Brevo generated with the authoritative DNS provider and at least one public resolver. Confirm that the record type, owner, and complete value or CNAME target match Brevo's current account screen. For an SPF record, use the [SPF checker](/tools/spf) as a public lookup after the DNS change. It can inspect the published SPF policy, but it cannot prove that Brevo sent a message through the intended return path. ### Check the Brevo status Return to the selected domain in Brevo and confirm the domain's current authentication status. Capture the status and time in the change record. This validates Brevo's view of the configuration at that moment. It does not prove that every sender using the domain has the same authentication result. ### Inspect a delivered message Open raw source for a newly delivered Brevo message. Check the `DKIM-Signature` field for the expected `d=` domain and selector, then review the receiver-added `Authentication-Results` field. [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html) defines `Authentication-Results` and explains that a result is meaningful only in the context of the receiver that added it. Confirm `dkim=pass`, then compare the signing domain with the visible From domain for DMARC alignment. ### Review DMARC reports After aggregate reports have accumulated, review the Brevo sending source separately from other sources that use the same domain. Look for DKIM and SPF alignment results, unexpected source domains, and failures that occur only on a particular path. ## Troubleshooting ### Brevo cannot verify the domain Compare the exact DNS owner and value in Brevo with the authoritative DNS answer. Check for a duplicated zone suffix, a truncated TXT value, or a CNAME entered as TXT. Do not create replacement records until you know which record differs. Repeated edits can extend propagation time and obscure the original change. ### The DKIM record exists but the message does not pass DKIM Confirm that the tested message was sent after Brevo showed the domain as authenticated. Then compare its `d=` and `s=` values with the published record for that selector. If the message used another selector or signing domain, the DNS record you added may belong to a different sending path. Keep the raw headers, redact recipient data, and compare the path with the selected Brevo domain. ### SPF is failing after a DNS change Check whether two SPF TXT policies now exist at the same domain. If so, restore the single approved policy and merge only the authorized mechanisms. Do not remove existing mail-system mechanisms just to add Brevo. Removing an existing provider can break SPF for mail that does not pass through Brevo. ### DKIM passes but DMARC fails Compare the DKIM `d=` value and the SPF authenticated domain with the visible From domain. A valid signature without DMARC alignment does not produce a DKIM-aligned DMARC pass. ### Brevo shows authenticated but recipients still see failures Treat the vendor indicator and the delivered-message result as separate checks. Inspect a new message sent through the same production campaign, sender identity, and route. If the result differs, use the receiver's headers and the relevant Brevo configuration as evidence rather than relying on a public DNS lookup alone. ## Check the DMARC policy after authenticating Brevo Once Brevo accepts the domain and a real Brevo message has passed DKIM, inspect the published DMARC record before changing enforcement. The remaining gap is visibility into other production senders that use the same From domain. A Brevo-specific repair does not inventory those sources or show whether they align. [Check the DMARC record](/tools/dmarc). A public DMARC record check cannot repair Brevo configuration, monitor all sending sources over time, or guarantee delivery. Palisade is AI-first, agent-first DMARC software that analyzes DMARC aggregate-report data, identifies authentication and alignment issues, and proposes prioritized remediation work. A human reviews the evidence and applies any DNS or policy change. [Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=how-do-i-set-up-spf-and-dkim-for-brevo). For a provider-specific implementation of these authentication checks, see [How do I set up SPF and DKIM for Amazon SES?](/learning/how-do-i-set-up-spf-and-dkim-for-amazon-ses). ## Sources and further reading - [Brevo: Authenticate your domain with Brevo: Brevo code, DKIM, DMARC](https://help.brevo.com/hc/en-us/articles/12163873383186-Authenticate-your-domain-with-Brevo-Brevo-code-DKIM-DMARC) - [RFC 6376: DomainKeys Identified Mail](https://www.rfc-editor.org/rfc/rfc6376.html) - [RFC 7208: Sender Policy Framework](https://datatracker.ietf.org/doc/html/rfc7208) - [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance](https://datatracker.ietf.org/doc/html/rfc9989) - [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html) ## Frequently asked questions ### Do I need to add an SPF record for standard Brevo domain authentication? No. Follow the records shown in the selected Brevo account. Add or merge SPF only when Brevo's applicable configuration, such as a dedicated-IP setup, explicitly provides an SPF requirement. ### Can I create a second SPF TXT record for Brevo? No. Multiple SPF records at one domain cause SPF PermError under RFC 7208. Merge the approved Brevo mechanism into the existing SPF policy when it is required. ### Does Brevo use a DKIM TXT record or CNAME records? Yes. Brevo can display one DKIM TXT record or two DKIM CNAME records. Use the record type, host, and value or target displayed for your selected account and sending domain. ### Does a green Brevo authentication status prove DMARC passes? No. It shows Brevo accepted the DNS configuration, but it does not prove a receiving mailbox evaluated a specific delivered message as DKIM-aligned or SPF-aligned for DMARC. ### Can I replace an existing DMARC record with the one Brevo shows? Only after reviewing the existing DMARC policy and reporting addresses. Replacing an existing record can remove monitoring or change the policy that other senders on the domain depend on.