Brevo (Sendinblue) SPF and DKIM Setup: A Deliverability Guide
Set up SPF, DKIM, and DMARC for Brevo (formerly Sendinblue). Step-by-step authentication guide with the correct include values and troubleshooting tips.
Brevo (formerly Sendinblue) is a popular email platform for small and mid-size businesses. Like all ESPs, Brevo requires proper domain authentication to achieve good deliverability. Without it, your emails risk going to spam or being rejected by Gmail, Yahoo, and Microsoft.
Here's the exact setup process, the correct DNS values, and how to troubleshoot common issues.
The SPF Include Value
The most-searched question about Brevo authentication: what's the SPF include value?
include:spf.brevo.com
Add this to your existing SPF record. If you use Google Workspace for business email and Brevo for marketing:
v=spf1 include:_spf.google.com include:spf.brevo.com ~all
If you set up your SPF record when the platform was still called Sendinblue, include:spf.sendinblue.com may still work — but update it to include:spf.brevo.com to stay current. Brevo maintains both for backward compatibility, but the legacy domain could be deprecated.
Check your SPF record to verify it's valid after adding the include.
Complete Authentication Setup
Step-by-Step
Go to Brevo's domain settings
Navigate to Settings → Senders, Domains & Dedicated IPs → Domains. Click "Add a domain."
Enter your domain
Enter the domain you send from (e.g., yourdomain.com). Brevo generates DNS records for authentication.
Add the DKIM record
Brevo provides a TXT record for DKIM. Add it to your DNS at the specified hostname (typically mail._domainkey.yourdomain.com).
The record contains Brevo's DKIM public key that receiving servers use to verify your email signatures.
Add the SPF include
Add include:spf.brevo.com to your existing SPF record. Don't create a second SPF record.
Add the DMARC record (if you don't have one)
If you don't already have a DMARC record, add one at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:[email protected]
This satisfies the minimum requirement for bulk sender compliance.
Verify in Brevo
Return to Brevo and click "Verify." Brevo checks all DNS records. Verification typically completes within a few minutes, but DNS propagation can take up to 48 hours.
Verify Authentication Is Working
After setup, send a test email through Brevo. In Gmail:
- Open the test email
- Click the three dots → "Show original"
- Check the authentication results:
SPF: PASSDKIM: PASSDMARC: PASS
If any of these fail, review your DNS records against the values in Brevo's dashboard.
Check your Brevo authentication
Run a free deliverability check on your domain. Verify SPF, DKIM, DMARC, and blacklist status in one scan.
Common Brevo Setup Issues
SPF Record Not Passing
| Problem | Solution |
|---|---|
| Missing include value | Add include:spf.brevo.com to your SPF record |
| Using old Sendinblue include | Update to include:spf.brevo.com |
| Multiple SPF records | Merge into one — only one v=spf1 record allowed per domain |
| Over 10 DNS lookups | Remove unused includes or use subdomains to split sends |
| SPF record on wrong domain | The record must be on the domain in your From address |
DKIM Not Verifying
Common DKIM problems with Brevo:
- TXT record not added — Check your DNS for the DKIM TXT record at the hostname Brevo specified
- Record value truncated — Some DNS providers have character limits. Ensure the full key value was pasted
- Wrong record type — Brevo requires a TXT record, not a CNAME. Some providers auto-detect; others need manual selection
- DNS caching — If you recently changed the record, wait for TTL expiration (up to 48 hours)
Domain Shows "Not Authenticated" in Brevo
If Brevo's dashboard still shows your domain as unauthenticated after adding DNS records:
- Wait at least 1–2 hours for DNS propagation
- Click "Verify" again in Brevo's domain settings
- Check each DNS record individually using a DNS lookup tool
- If using Cloudflare, ensure DNS-only mode (grey cloud) for authentication records
Brevo Deliverability Best Practices
Shared vs Dedicated IP
Brevo offers dedicated IPs on higher-tier plans. The decision framework:
| Your Situation | Recommendation |
|---|---|
| Under 25,000 emails/month | Shared IP — Brevo manages reputation for you |
| 25,000–100,000 emails/month | Consider dedicated — if you have deliverability concerns |
| Over 100,000 emails/month | Dedicated IP — full reputation control |
If you choose a dedicated IP, warm it up before sending full volume. Brevo provides warmup guidance in their documentation.
Contact Management
Brevo's contact management features help maintain list quality:
- Automatic suppression — Brevo suppresses hard bounces and complaints automatically
- Engagement tracking — Use Brevo's engagement metrics to identify inactive contacts
- Segmentation — Create segments based on open and click activity for targeted sending
- Blacklist management — Regularly check your blacklist contacts and clean imported lists
Transactional vs Marketing Email
Brevo supports both transactional and marketing email. For best deliverability:
- Use separate sending profiles or subdomains for transactional and marketing email
- Don't mix promotional content in transactional emails (order confirmations, password resets)
- Transactional emails generally have better deliverability — keep them clean to maintain that advantage
Campaign Best Practices
- Send consistently — Irregular sending patterns cause reputation fluctuations
- Segment your audience — Send relevant content to engaged subscribers
- Clean before major sends — Remove inactive subscribers before important campaigns
- Test before sending — Use Brevo's preview and test features to check content and rendering
- Monitor per-campaign — Track opens, clicks, bounces, and complaints for every send
Monitoring Brevo Deliverability
In Brevo
Check your campaign statistics for:
- Delivery rate (accepted by receiving servers)
- Open rate
- Click rate
- Bounce rate (hard and soft)
- Unsubscribe rate
Outside Brevo
Brevo's metrics don't show the full picture. Also check:
- Google Postmaster Tools — Gmail-specific reputation and spam rate
- Blacklist status — Run periodic checks on your domain and sending IPs
- Authentication health — Use our free checker to verify SPF, DKIM, and DMARC regularly
Authentication can break without warning when DNS records change or when Brevo updates their infrastructure. Regular monitoring catches these problems early.