How to authenticate your domain in Brevo

The short version: Brevo authenticates a domain with a DKIM TXT record (so it can sign as you), a Brevo-code TXT record (to verify ownership), and it asks you to publish DMARC. Until the DKIM and code records resolve, Brevo marks the domain unauthenticated and your mail is signed by Brevo’s domain — which shows a “via” / “on behalf of” label and can fail DMARC for your brand. This guide covers the records, where to add them in Brevo, and how to confirm alignment.

The records Brevo needs

Brevo generates the exact hostnames and values per account — always copy those from the dashboard, not the placeholders below.

Brevo ownership code (TXT). A verification string Brevo has you publish at the domain root so it can confirm you control the DNS:

Type: TXT Host: example.com Value: "brevo-code:xxxxxxxxxxxxxxxx"   (exact code from your Brevo dashboard)

DKIM (TXT). Brevo signs with a selector (commonly on a mail._domainkey host) and publishes its public key there. This is the record that aligns DKIM for DMARC:

Type: TXT Host: mail._domainkey.example.com Value: "k=rsa; p=MIGfMA0GCSq..."   (full public key from your Brevo dashboard)

DMARC (TXT). Brevo prompts you to publish a DMARC record if you don’t already have one, so receivers have a policy to apply:

Type: TXT Host: _dmarc.example.com Value: "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Follow Brevo’s current screens: Authenticate your domain with Brevo (Brevo code, DKIM, DMARC).

Where to start in Brevo

In Brevo, open Senders, Domains & Dedicated IPs → Domains and add your domain. Brevo displays the code, DKIM and DMARC records with copy buttons. Paste each into your DNS host — see the registrar guides linked below — then click Authenticate this domain / Verify. Records typically propagate in minutes but can take up to a day; Brevo re-checks and marks each green when it resolves.

Why DMARC alignment matters here

DMARC passes only when SPF or DKIM aligns with the visible From: domain, not merely when it passes. Unauthenticated Brevo mail is DKIM-signed by Brevo’s own domain, which doesn’t align with you@example.com, so under p=quarantine or p=reject your campaigns can be junked. Publishing Brevo’s DKIM record makes it sign as example.com, which aligns and, being DKIM, survives forwarding. For why a valid signature can still fail DMARC, read why DKIM passes but DMARC fails; for the full model, the complete SPF/DKIM/DMARC guide. Tune your policy with the DMARC Generator.

Verify it worked

• Confirm the DKIM key resolves with the DKIM Checker (query the mail._domainkey selector, or whichever Brevo assigned).
• Check your SPF is valid and under ten lookups with the SPF Checker.
• Validate your policy with the DMARC Checker, then send a test campaign and confirm the header shows dkim=pass aligned to your domain and dmarc=pass, with no “on behalf of” label.

Keep DMARC monitoring on so a misconfigured source shows up in a report rather than a bounce wave.

Common mistakes

• Adding the Brevo code but not DKIM. The code only proves ownership; without the DKIM record Brevo still signs as its own domain and DMARC won’t align.
• Leaving the “on behalf of” label. That label persists until DKIM authenticates as your domain. Verify the DKIM record actually resolved.
• Publishing a second SPF record. If Brevo asks you to include its SPF and you already have a v=spf1 record, merge into the one record — never publish two.
• Truncating the DKIM TXT. Long keys may split across quoted strings; paste the whole value.
• Skipping DMARC. Without a DMARC record receivers have no policy and you get no reports. Start at p=none and ramp — see moving DMARC to reject safely.
• Expecting the inbox from auth alone. It’s necessary, not sufficient — verify your list with the Email Verifier and mind reputation.

Related setup guides: Mailchimp, Mailgun, Postmark, Klaviyo and Zoho Mail.