SPF record for Brevo

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Standard sending: your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Dedicated IP with Google Workspace (Brevo's merge example)

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:spf.brevo.com mx ~all

Use the exact value Brevo shows in your account. The mx term is part of Brevo's example record.

How SPF applies to Brevo mail

Brevo sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead. The exception is a dedicated IP: Brevo then provides an SPF record for your domain, such as the include:spf.brevo.com merge example above.

• Brevo's branded subdomain links to Brevo's infrastructure with a CNAME for SPF and the return path, which Brevo says enables full SPF alignment on your sending domain.
• Brevo says a domain can only have one SPF record and gives a merge example; check the result with an SPF checker.

How to add it

1. In Brevo, open the Domains settings and add your domain.
2. Publish the records Brevo shows: the Brevo code (TXT), the DKIM records and a DMARC record.
3. If you use Brevo's branded subdomain, also add the branded CNAME record: Brevo uses it for SPF and the return path.
4. Only with a dedicated IP: add the SPF value Brevo gives you to your existing SPF record, merging it into one record.

DKIM and DMARC alignment

Brevo's domain authentication is built on DKIM and DMARC: DKIM signs with your domain, so it aligns with your From address. Brevo says your domain should have only one DMARC record.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Brevo adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Brevo's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:spf.brevo.com when you don't have a dedicated IP. Brevo doesn't need it for standard authentication.
• Publishing Brevo's SPF value as a second record instead of merging it into the existing one.