Setup guide
Brevo: SPF, DKIM and DMARC
Brevo (formerly Sendinblue) authenticates with a verification code and two DKIM CNAME records, and asks for a DMARC record.
By Ahmet Karaca · Updated · Checked against Brevo documentation on
DNS records to add
@<brevo-code:… value from Brevo>Get this value from your provider's dashboard.Domain ownership verification
brevo1._domainkey<b1 target from Brevo>Get this value from your provider's dashboard.DKIM key 1
brevo2._domainkey<b2 target from Brevo>Get this value from your provider's dashboard.DKIM key 2
_dmarcv=DMARC1; p=none; rua=mailto:<your report address>Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.
DMARC policy and reports
Steps
- In Brevo open Senders, Domains & Dedicated IPs → Domains → Authenticate this email domain.
- Publish the records Brevo lists and click Authenticate.
Common mistakes
- Cloudflare's CNAME flattening converts Brevo's DKIM CNAMEs into TXT records and DKIM fails. Turn flattening off for those records.
- Automatic authentication offers to replace an existing DMARC record with Brevo's. To keep your own policy, authenticate the domain manually instead.
- Brevo flags a DMARC record that has no rua tag. Add ; rua=mailto:rua@dmarc.brevo.com to the existing record rather than publishing a second DMARC record.
- Amazon Route 53 and Google Domains won't accept a second record with the same type and name, so the brevo-code TXT must go on a new line of the existing root TXT record.
- Removing Brevo's records after the domain shows Authenticated can cause delivery problems or spam placement. Keep them for as long as you send through Brevo.
Good to know
- If your DNS host is Cloudflare, set the DKIM CNAMEs to DNS only (grey cloud).
Frequently asked questions
Do I need SPF or MX records to authenticate a domain in Brevo?
No. Brevo doesn't require them for domain authentication and provides them only when you set up a dedicated IP.
Can I use a 2048-bit DKIM key with Brevo?
Yes, but only with the two CNAME DKIM records. Brevo's single TXT DKIM record uses a 1024-bit key.
How long can Brevo take to show my domain as Authenticated?
Up to 48 hours for DNS changes to propagate. You can recheck during that time; if the domain still isn't authenticated after 48 hours, Brevo points you to its troubleshooting article or support.
Which domain should I authenticate in Brevo?
The domain or subdomain in your sender address, for example mycompany.com for marketing@mycompany.com. If you send from several domains, authenticate each one.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Brevo documentation.
Check your Brevo setup
Or open the SPF checker, DKIM checker or DMARC checker directly.