# DKIM record for Brevo

URL: https://iblockspam.com/dkim/brevo
Last updated: 2026-10-09

Record type: TXT or CNAME
Selectors: mail (TXT), 2 CNAMEs from your account
Key managed by: Provider (TXT key or CNAMEs)

Brevo (formerly Sendinblue) authenticates a sending domain with three or four records: a `brevo-code` TXT that proves ownership, a DKIM key, and a DMARC record. Depending on your account, the DKIM key is one TXT record (Brevo's API example uses `mail._domainkey`) or two CNAMEs, which let Brevo rotate keys without any action from you.

## DNS records

- Ownership code (TXT, host @): `brevo-code=abc123def456`
- DKIM key (TXT version) (TXT, host mail._domainkey): `v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…`
- DKIM 1 and DKIM 2 (CNAME version) (CNAME, host <DKIM 1 and DKIM 2 names from your Brevo account>): `<the two targets Brevo shows>` Accounts that get the CNAME version see two records labeled DKIM 1 and DKIM 2.
- DMARC (Brevo's recommended starting value) (TXT, host _dmarc): `v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com` Only if you don't already have a DMARC record. Keep one record per domain, with a `rua` tag.

## Set it up and turn on signing

- In Brevo, go to **Settings > Senders, Domains, IPs > Domains** and click **Add a domain**, or **Authenticate** next to one already listed.
- Brevo recommends its automatic option. To add records yourself, choose **Authenticate the domain yourself** and click **Continue**.
- Copy each record into your DNS, using the names and values Brevo shows for your account.
- Click **Authenticate this email domain**. Brevo checks the records and marks the domain as authenticated.

## DMARC alignment

Until the domain is authenticated, Brevo replaces the domain part of your From address with one of its own, such as `mycompany@5000001.brevosend.com`, so recipients never see mail claiming to be from your domain unsigned. Once it is authenticated, Brevo signs with your domain and your own From address is used.

## Key length and rotation

With the two-CNAME setup, Brevo says it can rotate keys periodically without any action from you; it doesn't give the interval or key length. A TXT key stays as it is until Brevo issues a new one. To move a domain from the TXT key to CNAMEs, Brevo asks you to contact its support team.

## Common mistakes

- **Skipping the brevo-code record.** It proves you own the domain; DKIM alone doesn't complete authentication.
- **A second DMARC record.** The automatic setup may offer to replace your DMARC record; if you already have one, keep a single record.
- **Expecting your own From address before authentication.** Brevo rewrites it to a brevosend.com address until the domain is authenticated.

**Q: What is the brevo-code TXT record?**
An ownership check. Brevo gives each domain a value like `brevo-code=abc123def456`, published as a TXT record on the domain itself, and checks it alongside the DKIM and DMARC records when you authenticate.

**Q: Why does Brevo change my sender address to brevosend.com?**
Because the domain isn't authenticated yet. Brevo replaces the domain part of the From address, for example with `5000001.brevosend.com`, until your brevo-code, DKIM and DMARC records are in place.

**Q: How do I switch Brevo DKIM from a TXT record to CNAMEs?**
Brevo asks you to contact its support team. The CNAME version uses two records, DKIM 1 and DKIM 2, which let Brevo rotate keys without you editing DNS.

Sources:
- Brevo Help Center: Authenticate your domain with Brevo (Brevo code, DKIM, DMARC): https://help.brevo.com/hc/en-us/articles/12163873383186
- Brevo Help Center: FAQs about domain authentication: https://help.brevo.com/hc/en-us/articles/17286219877778
- Brevo API reference: Get a sender domain configuration: https://developers.brevo.com/reference/getdomainconfiguration

---

Source: iBlockSpam, https://iblockspam.com/dkim/brevo (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt