Brevo SPF and DKIM Setup: Full Authentication Guide

If your emails are landing in spam — or you want to prevent them from doing so — SPF and DKIM authentication is the single most impactful thing you can do. This guide explains what these records are and how to set them up correctly in Brevo.

What Are SPF and DKIM?

SPF (Sender Policy Framework) is a DNS record that tells receiving mail servers which servers are authorised to send email on behalf of your domain. Without it, anyone could theoretically send emails that look like they came from your domain.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. Receiving servers use this signature to verify that the email was sent by an authorised sender and has not been tampered with in transit.

Together, SPF and DKIM form the foundation of email authentication. Without them, even well-crafted, permission-based emails frequently end up in spam.

Why This Matters for Brevo

When you use Brevo to send emails from your domain (e.g., hello@yourdomain.com), the emails technically originate from Brevo's servers — not your own. Without proper authentication, receiving servers have no way to verify this is legitimate, and many will route the email to spam.

Brevo makes it straightforward to add the required records. The process takes about 10 minutes and the results are permanent.

Step 1: Access Your Domain Settings in Brevo

Log into your Brevo account and go to Settings → Senders, Domains & Dedicated IPs → Domains.

Click Add a New Domain and enter your domain name (e.g., yourdomain.com). Brevo will then display the DNS records you need to add.

Step 2: Add the Brevo DKIM Record

Brevo will provide you with a TXT record for DKIM. It typically looks like:

• Type: TXT
• Name/Host: mail._domainkey.yourdomain.com (or just mail._domainkey depending on your registrar)
• Value: A long string beginning with v=DKIM1; k=rsa; p=...

Log into your domain registrar or DNS provider (examples: GoDaddy, Namecheap, Cloudflare, Google Domains) and add this TXT record exactly as shown.

In Cloudflare: DNS → Add Record → Type: TXT → Name: mail._domainkey → Content: paste the full value → Save.

In Namecheap: Advanced DNS → Add New Record → Type: TXT Record → Host: mail._domainkey → Value: paste the full value → Save.

Step 3: Set Up or Update Your SPF Record

Brevo requires that their sending servers are included in your domain's SPF record.

The Brevo SPF inclusion is: include:spf.brevo.com

If you don't have an SPF record yet, create a new TXT record:

• Name/Host: @ (or your domain name)
• Value: v=spf1 include:spf.brevo.com ~all

If you already have an SPF record, add the Brevo include to your existing record. You can only have one SPF record per domain. Example:

v=spf1 include:_spf.google.com include:spf.brevo.com ~all

Important: Do not create a second SPF record — this breaks SPF validation.

Step 4: Verify in Brevo

After adding your DNS records, return to Brevo's domain settings and click Verify. Brevo will check whether your records are correctly in place.

Allow for DNS propagation. DNS changes can take anywhere from a few minutes to 48 hours to propagate globally. If verification fails immediately, wait an hour and try again.

Step 5: Set Up DMARC (Recommended)

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on top of SPF and DKIM. It tells receiving servers what to do when an email fails authentication.

A basic DMARC record for Brevo users:

• Type: TXT
• Name: _dmarc
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none (monitoring mode) before moving to p=quarantine or p=reject. This gives you time to see any legitimate authentication failures before enforcing strict rules.

How to Check if Your Records Are Working

Use free tools like MXToolbox or Google's Email Markup Tester to verify your SPF, DKIM, and DMARC records are correctly published.

In Brevo, once your domain shows "Authenticated" status in the domain settings, you're good to go. Emails sent from Brevo will now carry your authenticated domain signature.

Brevo Pricing at a Glance

All plans include unlimited contact storage. See full pricing on Brevo →