Brevo SPF, DKIM & DMARC Setup Guide

Overview

Brevo — formerly known as Sendinblue — is an all-in-one marketing platform popular with EU-based SMBs for email campaigns, transactional messages, and CRM. Its SPF record uses include:spf.brevo.com, costing 1 DNS lookup. DKIM uses the mail selector with a 2048-bit RSA key, published either as a TXT record or via CNAME delegation depending on setup method.

Domain Authentication

Brevo offers automatic domain authentication for supported DNS providers — it detects your DNS host and adds records directly. Manual setup requires publishing a TXT record for DKIM at mail._domainkey.yourdomain.com plus a Brevo-code TXT record for domain ownership verification. Without completing domain authentication, Brevo sends from its own domain (brevo.com), causing both SPF and DKIM alignment failures under any DMARC policy.

DKIM Record Hostname Pitfall

Some DNS providers require the full hostname (e.g., mail._domainkey.yourdomain.com) in the record name, while others auto-append the domain suffix. This is the most common source of DKIM verification failures with Brevo — the record exists but at the wrong hostname. If your DNS provider auto-appends, enter mail._domainkey only. If it does not, enter the full mail._domainkey.yourdomain.com.

Additional Setup Notes

Sendinblue to Brevo SPF Migration

If migrating from Sendinblue, the SPF include mechanism changed from sendinblue.com to spf.brevo.com. Old Sendinblue SPF includes still resolve but may be deprecated without notice — update your DNS record to the current include. There is no technical urgency (both resolve to the same infrastructure today), but relying on a deprecated include is a reliability risk. Check your SPF record for any reference to sendinblue.com and replace it with spf.brevo.com.

Brevo and Mailjet Coexistence

Brevo and Mailjet are sibling products (both part of the Sendinblue family) but use separate SPF includes and separate DKIM configurations. Running both services requires two SPF lookups — include:spf.brevo.com and include:spf1.mailjet.com. Managed SPF can flatten these into direct IP references if you're running tight on lookup budget.

Troubleshooting

DKIM Verification Fails in Brevo Dashboard

If Brevo reports that DKIM verification failed after you've published the TXT record:

1. Check the hostname format — This is the most common issue. Query mail._domainkey.yourdomain.com with a DNS lookup tool. If it returns nothing, your record is likely at the wrong hostname (e.g., mail._domainkey.yourdomain.com.yourdomain.com due to auto-appending).
2. Check for line breaks — The DKIM TXT record for a 2048-bit key is long. Some DNS control panels introduce line breaks during copy-paste that corrupt the record. The value must be a single continuous string.
3. Check propagation — DNS changes can take up to 48 hours, though most propagate within 1-2 hours. Use an external DNS checker rather than relying on local resolution.
4. Check for CNAME conflicts — If a CNAME record exists at mail._domainkey.yourdomain.com (from a previous setup or another provider), the TXT record may be ignored. Remove any conflicting CNAME before publishing the TXT record.

Brevo-Code Verification Record Not Detected

Brevo requires a separate TXT record (the "Brevo-code") for domain ownership verification. This is a short string, not the DKIM key. If Brevo does not detect it, verify that you've placed it on the correct hostname — typically the apex domain or a specific subdomain as indicated by Brevo's setup wizard. The Brevo-code record can be removed after domain verification completes.

Emails Showing as "via brevo.com" in Gmail

If recipients see "via brevo.com" next to the sender name in Gmail, domain authentication is not complete. This label appears when Gmail detects that the DKIM signing domain or return-path domain does not match the From header domain. Complete both SPF and DKIM authentication in Brevo's dashboard to remove this label.

SPF PermError After Adding Brevo

Adding include:spf.brevo.com to an already-full SPF record pushes the lookup count past 10, causing PermError. This affects all providers in the SPF record, not just Brevo. Run an SPF check to see your total lookup count. If you're at the limit, audit for unused includes or switch to Managed SPF.

Edge Cases and Gotchas

Automatic Domain Authentication Caveats

Brevo's automatic DNS configuration works with a limited set of providers (Cloudflare, OVH, GoDaddy, and others). When it works, it saves time — but always verify the records it created. Automatic systems can create duplicate records, place records at the wrong hostname, or fail silently. After automatic setup, query your DNS records externally to confirm they resolve correctly.

Transactional vs. Marketing Email Streams

Brevo handles both transactional and marketing email from the same account, using the same domain authentication. There is no separate SPF include for transactional vs. marketing — both streams use include:spf.brevo.com and the same DKIM key. This simplifies DNS but means you cannot isolate the reputation of your transactional email from your marketing email at the DNS authentication level. If reputation isolation is critical, consider using a subdomain for one stream.

Subdomain Sending

Brevo supports sending from subdomains, but each subdomain must be authenticated independently. The DKIM record must be at mail._domainkey.subdomain.yourdomain.com, and the Brevo-code verification record must be on the subdomain as well. The parent domain's authentication does not cascade.

Multiple Brevo Accounts

If your organization runs multiple Brevo accounts (e.g., different departments), all accounts on the same domain share the mail DKIM selector. Only one DKIM key can be published at mail._domainkey.yourdomain.com. Multiple Brevo accounts on the same domain is not officially supported — use subdomains to separate the accounts if this is required.

GDPR and Data Residency

Brevo markets heavily on GDPR compliance and EU data residency. The email infrastructure is EU-based, which can matter for organizations with strict data residency requirements. However, the DNS authentication setup (SPF, DKIM, DMARC) is identical regardless of data residency — these are public DNS records and do not contain personal data.

Migration Notes

Migrating from Sendinblue to Brevo

If your DNS still references sendinblue.com in the SPF include, replace it with spf.brevo.com. The DKIM selector and record format are unchanged — no DKIM changes are needed for the rebrand. The Brevo-code verification record may need to be re-verified if you changed accounts during the transition.

Migrating to Brevo from Another Provider

Add include:spf.brevo.com to your SPF record and publish the DKIM TXT record at mail._domainkey.yourdomain.com before switching traffic. Complete domain authentication in Brevo's dashboard, publish the Brevo-code verification record, and send test messages to confirm SPF and DKIM alignment. Keep the old provider's records in place until DMARC aggregate reports confirm zero volume from the old infrastructure.

Migrating Away from Brevo

Remove include:spf.brevo.com from your SPF record, delete the DKIM TXT record at mail._domainkey.yourdomain.com, and remove the Brevo-code verification TXT record. If you still have the legacy sendinblue.com include in your SPF record, remove that too. Check DMARC reports for one full cycle to confirm no residual traffic before completing DNS cleanup.