Brevo (Sendinblue) SPF & DKIM Setup: Enterprise Guide
This guide helps you configure SPF, DKIM, and DMARC alignment for Brevo (formerly Sendinblue), ensuring authenticated mail and strong deliverability across major inbox providers.
Why It Matters
- SPF authorizes Brevo’s sending infrastructure to send on your domain’s behalf.
- DKIM cryptographically signs your mail, proving it wasn’t altered and enabling DMARC alignment.
- DMARC uses SPF/DKIM results and alignment to enforce policy (monitor, quarantine, reject) against spoofing.
Prerequisites
- Access to your DNS provider (e.g., Cloudflare, Route 53, GoDaddy).
- Admin access in Brevo to add and authenticate domains.
- Clear sending domain strategy (root domain vs subdomain, e.g.,
mail.example.com).
Step-by-Step: Configure in Brevo
- Add your domain in Brevo: In Brevo, go to Settings Senders & IP Domains (sometimes labeled as Authentication). Add the domain you will send from and choose to authenticate it.
- Publish SPF:
- Publish DKIM:
- Verify ownership: After DNS propagation (TTL), click Verify in Brevo. You should see SPF and DKIM as Valid/Authenticated.
- Send test messages: Use a seed list (Gmail, Outlook, Yahoo). In Gmail, open “Show originalto confirm SPF=PASS, DKIM=PASS, and DMARC=PASS with alignment.
DMARC Alignment and Policy
- Publish a DMARC record at
_dmarc.example.com. Start with monitoring:
Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1
- Ensure alignment:
- DKIM: the
d= signing domain should match or be a subdomain of the visible From domain.
- SPF: the envelope-from (Return-Path) domain should match or be aligned with the From domain if relying on SPF alignment.
- Gradually enforce policy: move to
p=quarantine, then p=reject once authentic traffic aligns and passes consistently.
DNS Record Examples
Examples below are illustrative; always prefer records shown in your Brevo dashboard.
SPF: v=spf1 include:spf.brevo.com -all
Alt: v=spf1 include:spf.sendinblue.com -all
DKIM: Host: mail._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjAN... (truncated)
Advanced Configuration
- Subdomain strategy: Use a dedicated subdomain (e.g.,
mail.example.com) to isolate marketing traffic.
- Multiple ESPs: Merge includes into a single SPF record; avoid duplicates. Consider SPF flattening if mechanisms exceed limits.
- Key rotation: Rotate DKIM keys annually or after personnel/vendor changes; maintain at least two selectors for smooth cutovers.
- BIMI readiness: Enforce DMARC at quarantine/reject, publish a compliant SVG logo, and consider a VMC to unlock wider adoption.
Troubleshooting
- SPF not passing: Check for duplicate TXT records, wrong include domain, or missing Brevo sending IP authorization.
- DKIM pending: Confirm selector host is correct and not auto-suffixed by the DNS UI; wait for TTL, and ensure no extra quotes/whitespace in the TXT value.
- DMARC not aligned: If the
d= DKIM domain differs from From, enable DKIM alignment in Brevo by signing with your domain; for SPF, align the envelope-from or rely on DKIM alignment.
- Propagation delays: Some DNS providers take up to several hours; re-verify later.
Best Practices
- Keep a single SPF record; merge mechanisms when adding services.
- Prefer DKIM alignment as primary DMARC pass path; treat SPF as complementary.
- Monitor DMARC aggregate reports; remediate sources failing alignment before tightening policy.
- Document selectors, rotation windows, and change approvals in your runbook.
Validation & Screenshots
- Gmail: Show original
- Open a test email in Gmail click the three dots Show original.
- Confirm headers show: SPF: PASS, DKIM: PASS, DMARC: PASS.
- Outlook (Microsoft 365): Message Header Analyzer
- Platform tools
FAQ
Can I use both include:spf.sendinblue.com and include:spf.brevo.com?
No. Use only one include whichever Brevo shows in your dashboard. Having both can bloat SPF and risk evaluation errors.
Do I need a dedicated subdomain for Brevo?
Not required, but recommended for traffic isolation and reputation control. If used, authenticate the subdomain in Brevo and publish SPF/DKIM there.
When should I move DMARC to reject?
After 2 weeks of stable aggregate reports with aligned, authenticated traffic and no legitimate sources failing. Move from p=none p=quarantine p=reject.
Does a dedicated IP improve deliverability?
It can, if you maintain low complaint rates, consistent cadence, and proper warm-up. Authentication remains foundational.
