Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Brevo

Brevo (formerly Sendinblue) authenticates a sending domain with three or four records: a brevo-code TXT that proves ownership, a DKIM key, and a DMARC record. Depending on your account, the DKIM key is one TXT record (Brevo's API example uses mail._domainkey) or two CNAMEs, which let Brevo rotate keys without any action from you.

Record type
TXT or CNAME
Selectors
mail (TXT), 2 CNAMEs from your account
Private key held by
Provider (TXT key or CNAMEs)

The DNS records

Brevo shows the exact records for your account under Domains. The values below are the examples from Brevo's API reference.

Ownership code

Type: TXT · Host: @ 

brevo-code=abc123def456

DKIM key (TXT version)

Type: TXT · Host: mail._domainkey 

v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…

DKIM 1 and DKIM 2 (CNAME version)

Type: CNAME · Host: <DKIM 1 and DKIM 2 names from your Brevo account> 

<the two targets Brevo shows>

Accounts that get the CNAME version see two records labeled DKIM 1 and DKIM 2.

DMARC (Brevo's recommended starting value)

Type: TXT · Host: _dmarc 

v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com

Only if you don't already have a DMARC record. Keep one record per domain, with a rua tag.

Set it up and turn on signing

  1. In Brevo, go to Settings > Senders, Domains, IPs > Domains and click Add a domain, or Authenticate next to one already listed.
  2. Brevo recommends its automatic option. To add records yourself, choose Authenticate the domain yourself and click Continue.
  3. Copy each record into your DNS, using the names and values Brevo shows for your account.
  4. Click Authenticate this email domain. Brevo checks the records and marks the domain as authenticated.

DMARC alignment

Until the domain is authenticated, Brevo replaces the domain part of your From address with one of its own, such as mycompany@5000001.brevosend.com, so recipients never see mail claiming to be from your domain unsigned. Once it is authenticated, Brevo signs with your domain and your own From address is used.

Key length and rotation

With the two-CNAME setup, Brevo says it can rotate keys periodically without any action from you; it doesn't give the interval or key length. A TXT key stays as it is until Brevo issues a new one. To move a domain from the TXT key to CNAMEs, Brevo asks you to contact its support team.

Common mistakes

  • Skipping the brevo-code record. It proves you own the domain; DKIM alone doesn't complete authentication.
  • A second DMARC record. The automatic setup may offer to replace your DMARC record; if you already have one, keep a single record.
  • Expecting your own From address before authentication. Brevo rewrites it to a brevosend.com address until the domain is authenticated.

Check your Brevo DKIM key

Enter your domain and the selector from your Brevo account. Free, reads public DNS only.

Frequently asked questions

What is the brevo-code TXT record?

An ownership check. Brevo gives each domain a value like brevo-code=abc123def456, published as a TXT record on the domain itself, and checks it alongside the DKIM and DMARC records when you authenticate.

Why does Brevo change my sender address to brevosend.com?

Because the domain isn't authenticated yet. Brevo replaces the domain part of the From address, for example with 5000001.brevosend.com, until your brevo-code, DKIM and DMARC records are in place.

How do I switch Brevo DKIM from a TXT record to CNAMEs?

Brevo asks you to contact its support team. The CNAME version uses two records, DKIM 1 and DKIM 2, which let Brevo rotate keys without you editing DNS.

Sources

Checked against Brevo's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Brevo

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated