Brevo: DKIM and DMARC setup
How to authenticate your sending domain in Brevo — add the domain, add the Brevo code, DKIM and DMARC records, and confirm the Authenticated status — with each step linked to Brevo's current help center.
This guide follows Brevo's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Brevo's current help page win.
For the protocols themselves, see SPF and DMARC.
Before you start
- You need access to your domain's DNS settings, usually at your registrar or hosting provider.
- Send from an address on a domain you own. Brevo's help says: "You can only authenticate a domain that you or your business own and control. Domains from free email services, such as Gmail or Yahoo (e.g., @gmail.com or @yahoo.com), cannot be authenticated." (Authenticate your domain with Brevo)
- Brevo is gradually rolling out a new domain setup flow. If your account has it, follow Set up your domain in Brevo instead; this guide covers the current flow.
What Brevo asks you to publish
| Purpose | Record type | Count | Where the values come from |
|---|---|---|---|
| Domain ownership (Brevo code) | TXT |
1 | Name and value shown in Brevo |
| DKIM | TXT or CNAME |
1 TXT or 2 CNAME |
Shown in Brevo as DKIM record, or DKIM 1 and DKIM 2 |
| DMARC | TXT |
1 | Name and value shown in Brevo |
Brevo: "Depending on your Brevo account, you may need to add three or four records." (Authenticate your domain with Brevo)
Step 1 — Add the domain
- Click the account dropdown and select Settings > Senders, Domains, IPs > Domains.
- Click Add a domain. If the domain is already listed, click Authenticate next to it instead.
- Enter the domain, the part of your email address after the
@, and click Add domain.
Source: Authenticate your domain with Brevo.
Step 2 — Choose automatic or manual authentication
Authenticate the domain automatically is Brevo's default and recommended option: you log in to your domain provider from Brevo, and "Brevo will detect your provider, add the required DNS records (Brevo code, DKIM, DMARC), and verify the configuration." If your domain already has a DMARC record, this flow asks whether to replace it with Brevo's; to keep yours, authenticate manually instead.
For the manual path, select Authenticate the domain yourself. Brevo shows the records to copy into your domain provider's account. Ask someone else to authenticate the domain sends the instructions to another person instead.
Source: Authenticate your domain with Brevo.
Step 3 — Add the Brevo code and DKIM records
At your DNS provider, create the TXT record for the Brevo code with the name and value Brevo shows, using its copy buttons. Then add the DKIM record type your account shows: either DKIM 1 record and DKIM 2 record (CNAME), or one DKIM record (TXT).
If you use Cloudflare with CNAME DKIM records, deactivate CNAME flattening and the proxy toggle. Brevo: "If CNAME flattening is activated, Cloudflare converts the record to a TXT record, and DKIM authentication will fail."
Source: Authenticate your domain with Brevo.
Step 4 — Add the DMARC record
Create one TXT record with the DMARC name and value Brevo shows.
If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). Brevo also says "Your domain should have only one DMARC record." See DMARC before changing an existing policy.
Source: Authenticate your domain with Brevo.
Step 5 — Verify and check the status
In Brevo, click Authenticate this email domain at the bottom of the page with the DNS records. "It can sometimes take up to 48 hours for DNS changes to propagate and for your domain to appear as authenticated in Brevo." The status shows Authenticated, or a pop-up says "The domain is not authenticated yet"; you can repeat the check over the next 48 hours. After that, see Brevo's troubleshooting article or contact its support.
Source: Authenticate your domain with Brevo.
Step 6 — Keep the records in place
"Keep the DNS records as they are in your domain provider as long as you are using Brevo to send emails. Modifying or deleting these DNS records may lead to email delivery problems or your emails being marked as spam."
Source: Authenticate your domain with Brevo.
SPF
Brevo's help does not give an SPF record step for domain authentication. It says: "The SPF and MX records are not required to authenticate a domain. We only provide these records when setting up a dedicated IP." (Authenticate your domain with Brevo) This guide does not give one either.
How alignment works here
DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.
Check your setup
Once Brevo shows Authenticated, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.
The check looks for DKIM under a fixed list of common selectors, so it may not find your Brevo DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For Brevo, take it from the name of the DKIM record (or DKIM 1 record) shown in your account; Brevo's help does not list a fixed value.