Brevo authenticates a domain with three or four DNS records: a brevo-code TXT that proves ownership, DKIM as two CNAMEs (brevo1._domainkey and brevo2._domainkey) or one older TXT key, and a DMARC TXT record. Brevo does not ask for SPF on shared IPs. DMARC passes on DKIM alone unless you also set up a branded subdomain.
The records at a glance
| Record | Type | Host | Value |
|---|---|---|---|
| Brevo code | TXT | @ |
brevo-code: plus a hex string |
| DKIM 1 | CNAME | brevo1._domainkey |
b1.example-com.dkim.brevo.com |
| DKIM 2 | CNAME | brevo2._domainkey |
b2.example-com.dkim.brevo.com |
| DMARC | TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com |
The host names come from Brevo's troubleshooting article. Brevo shows the values only inside your account. The pattern in the table is what we read on 19 October 2026 from Brevo's own domains: brevo1._domainkey.brevo.com pointed to b1.brevo-com.dkim.brevo.com, and sendinblue.com pointed to b1.sendinblue-com.dkim.brevo.com. Your domain, with dots turned into dashes, sits in the middle. Always paste the exact value Brevo gives you.
Where to do it in Brevo
- Open the account drop-down and go to Settings > Senders, Domains, IPs > Domains.
- Click Add a domain (or Authenticate if it is already listed) and enter the part after the @, such as
example.com. - Choose Authenticate the domain automatically or Authenticate the domain yourself.
The automatic option signs in to your DNS host and writes every record. The manual option gives you copy buttons for each name and value. A third choice, Ask someone else to authenticate the domain, emails the instructions to whoever runs your DNS. They do not need a Brevo login.
Brevo is rolling out a newer Set up your domain flow that bundles authentication, a branded subdomain and dedicated IP association. If your account has it, the screens differ, but the DKIM and DMARC records are the same kind.
DKIM: CNAME pair or single TXT
Brevo has two generations of DKIM.
- Two CNAMEs (current).
brevo1andbrevo2point into Brevo's zone. The key is 2048-bit by default, and Brevo rotates between the two. You never touch DNS for a rotation. - One TXT (older). A 1024-bit key pasted straight into your zone. It still works. Domains on it see a banner asking them to add the two CNAMEs instead.
Switch if you can. A 2048-bit TXT key runs past the 255-character limit many DNS panels impose on a single string, so the CNAME route avoids that problem as well as giving you rotation.
Either way the signature carries d=example.com. Under DMARC's relaxed alignment (RFC 7489) that matches a From address at example.com or any subdomain of it.
SPF and the branded subdomain
Brevo's FAQ answers the SPF question plainly: SPF and MX records are not needed to authenticate a domain, and Brevo only hands them out for dedicated IPs.
The reason is the return path. By default Brevo bounces mail to its own domain, brevosend.com. SPF is checked against that domain and passes, but it is Brevo's domain, not yours, so it never aligns with your From address. In our scan of the Tranco top 1,000 domains on 19 October 2026, just one domain still listed include:spf.sendinblue.com in SPF. Adding it would not change the DMARC result on shared IPs.
A branded subdomain fixes the alignment. You pick something like mail.example.com and add Brevo's Branded record CNAME. Brevo then uses that subdomain for the return path, click tracking (r.mail.example.com) and images (img.mail.example.com). SPF now passes on a subdomain of your own domain, so it aligns too, and you have two independent passes instead of one. Brevo calls this the safer basis for p=quarantine or p=reject. It is required for dedicated IP users in the new flow and optional for everyone else. Dedicated IP users also get an A record such as ip1.mail.example.com.
DMARC
Brevo's record uses rua=mailto:rua@dmarc.brevo.com. Brevo publishes the same thing on its own domain: on 19 October 2026 _dmarc.brevo.com read v=DMARC1; p=reject; sp=reject; rua=mailto:rua@dmarc.brevo.com;.
If your domain already has a DMARC record, do not add a second one. Brevo's help centre says to edit the existing record and append ; rua=mailto:rua@dmarc.brevo.com if it lacks an rua tag. You can list your own report address as well, separated by a comma.
Pitfalls specific to Brevo
The automatic flow can replace your DMARC record. Brevo asks before it does. If your record carries a stricter policy or a reporting address you rely on, decline and go manual.
Cloudflare. Turn off the proxy on both DKIM CNAMEs. Brevo also says to switch off CNAME flattening, because a flattened record becomes a TXT and DKIM fails.
Doubled host names. Some hosts append the domain. If brevo1._domainkey.example.com turns into brevo1._domainkey.example.com.example.com, enter just brevo1._domainkey, or add a trailing dot to the full name.
From domain mismatch. Brevo lists this as a common DMARC failure: the records exist, but the campaign's From address uses a domain you did not authenticate. Authenticate each sending domain or subdomain separately.
Removing records later. Brevo says to leave all of them in place for as long as you send through it.
Check the result
- DKIM checker: your domain with selector
brevo1, thenbrevo2. - DMARC checker: one record only, with an
ruatag. - SPF checker: only matters if you set up a branded subdomain or a dedicated IP. Check the subdomain, not the root.
In Brevo, click Authenticate this email domain on the manual setup screen to re-check. Brevo allows up to 48 hours for DNS to show. Then send a test to Gmail and look for dkim=pass header.d=example.com and dmarc=pass in Show original.