DKIM and DMARC for Brevo: authenticate your sending domain
Add the Brevo code, the two DKIM records and the DMARC record, keep your own DMARC reports, and check that Brevo signs your campaigns with your domain.
Until a domain is authenticated in Brevo, mail sent in its name is not signed by it; Brevo may even replace the sender address with one of its own. Authenticating takes four DNS records. This guide follows Brevo’s help pages, read on 14 November 2026.
1. Add the domain
In Brevo, open Settings → Senders, Domains, IPs → Domains and click Add a domain (or Authenticate next to a domain already listed). Enter the part of your address after the @.
Brevo can add the records itself by logging in to your DNS provider. The manual method, Authenticate the domain yourself, shows the records to copy; it is the one described here.
2. The four records
| Record | Type | Host | What it does |
|---|---|---|---|
| Brevo code | TXT | the domain itself (@) |
Proves you control the domain |
| DKIM 1 | CNAME | brevo1._domainkey |
Signs your mail (rotated with DKIM 2) |
| DKIM 2 | CNAME | brevo2._domainkey |
Signs your mail (rotated with DKIM 1) |
| DMARC | TXT | _dmarc |
Tells receivers what to do with mail that fails |
Copy each name and value from Brevo. If your DNS provider adds the domain to the host by itself, enter brevo1._domainkey, not the full name. Older accounts may have a single DKIM record of TXT type with a 1024-bit key: Brevo lets you switch to the two CNAME records, which carry a stronger key and rotate.
You do not need to touch SPF on Brevo’s shared addresses: SPF passes on Brevo’s own return-path domain, and DMARC passes through the DKIM signature made with your domain. An SPF change is only asked for with a dedicated IP.
3. DMARC: keep one record, and your reports
A domain must have one DMARC record. If you already have one, do not add Brevo’s next to it: edit yours.
Brevo asks for a rua= tag in the record and proposes its own address, rua@dmarc.brevo.com. The reports then go to Brevo, not to you. To keep reading who sends in your name, list your own address as well; rua= accepts several, separated by commas:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.example,mailto:rua@dmarc.brevo.comIf your policy is already p=quarantine or p=reject, Brevo requires the domain to be authenticated before you can create a sender on it: do the DNS work first.
4. Confirm
Back on the Domains page, click Authenticate this email domain. Brevo checks each record; allow up to 48 hours for the DNS change to spread, and press the button again. On the Senders page, each sender should show a green mark for the DKIM signature and for the DMARC policy.
Then send a real campaign to one of your mailboxes and read the headers: dkim=pass with your domain. The e-mail header analyzer reads them for you.
What goes wrong
- The sender shows as @brevosend.com: the domain is not authenticated, so Brevo replaced the address.
- A record “does not match”: the host was doubled by the DNS provider, or the value was cut. Try the short host (
brevo1._domainkey), then the full one. - Several DMARC records: receivers ignore them all. Merge them into one.
- The TXT key is too long for the provider: switch to the two CNAME records.
- Brevo passes, DMARC still fails: another service sends in your name. The DMARC report reader shows which one, provided the reports come to you.
When everything that sends in your name passes, follow From p=none to p=reject.