Brevo SMTP Relay Setup with SPF DKIM and DMARC 2026

Why does Brevo SMTP relay setup with SPF, DKIM, and DMARC matter?

You’ve set up your Brevo SMTP relay. You’re sending emails. But why are some landing in spam, others bouncing silently?

It’s not the content. It’s not the timing. It’s likely that your domain’s email authentication is broken — and that’s what’s killing deliverability.

SPF, DKIM, and DMARC aren’t optional extras. They’re the foundation of email trust. Without them, even legitimate messages from Brevo can be rejected by Gmail, Outlook, or Apple Mail.

Think of them like a three-tiered identity check: SPF confirms the server is authorized, DKIM signs the message content, and DMARC tells receivers what to do if either check fails. Miss one, and your sender reputation takes a hit.

Even one missing record can lead to a 30–50% drop in inbox placement — not just occasional bounces, but hard rejections and long-term blocks.

Key takeaways

• SPF, DKIM, and DMARC together prevent spoofing and improve inbox placement for emails sent via Brevo SMTP relay.
• A misconfigured or missing DMARC policy can cause deliverability failures even if SPF and DKIM are correct.
• Without proper authentication, messages from Brevo may be rejected by major inboxes, increasing bounce rates and damaging sender reputation.

How do SPF, DKIM, and DMARC work together in Brevo SMTP relay?

You use SPF, DKIM, and DMARC together to prove your emails are legitimate, not spoofed. SPF says which servers can send from your domain. DKIM signs each email so the content can’t be altered in transit. DMARC tells receiving servers what to do if SPF or DKIM fails—like reject or quarantine. Together, they stop fraud, boost inbox placement, and build sender reputation. Think of them as layers: SPF checks the sender’s identity, DKIM protects content integrity, and DMARC enforces policy. This setup is essential for reliable delivery, especially when using Brevo SMTP relay.

Core roles of SPF, DKIM, and DMARC in authentication

Without all three, even correctly sent messages can fail. A single failed check may trigger rejection. SPF alone doesn't stop content tampering. DKIM alone doesn’t verify sender identity. DMARC without SPF or DKIM has no enforcement power. Together, they form a complete trust chain.

You can test your setup with tools like MailTester’s inbox placement tester, which checks whether your configured authentication passes real-world inbox filters. Use the bulk verification tool to clean your list before sending—invalid or risky addresses can harm your reputation, even with perfect authentication.

For API-driven workflows, MailTester’s real-time API helps verify addresses at scale before delivery. This is especially useful if you integrate with Brevo, as it reduces the number of emails sent to non-existent or non-receiving accounts.

Step-by-step: Set up SPF for Brevo SMTP relay

You need to add a TXT record to your domain’s DNS settings with v=spf1 include:spf.brevo.com -all to authenticate emails sent via Brevo SMTP. This tells receiving servers that Brevo is authorized to send on your behalf, reducing spam flags and improving inbox placement. Without it, messages may be marked as spam or rejected outright.

Set up SPF using your domain’s DNS provider

1. Log in to your domain’s DNS provider — such as GoDaddy, Cloudflare, or Namecheap.
2. Navigate to the DNS management section and create a new TXT record.
3. Set the name field to @ (or leave it blank, depending on your provider’s interface).
4. Enter the value: v=spf1 include:spf.brevo.com -all. This includes Brevo’s sending servers and explicitly denies all others.
5. Save the record. DNS changes can take 1 to 24 hours to propagate globally.

Verify your SPF record is live

After saving, verify the record is active using a public DNS lookup tool like MxToolbox or DNSChecker.org. Enter your domain and check for the SPF TXT record. A successful lookup confirms your SPF setup is live.

SPF is part of a layered email authentication strategy — it works best alongside DKIM and DMARC. Misconfigurations can lead to hard bounces or delivery failures, even if your messages are legitimate. Always verify your setup before sending campaigns at scale.

For additional validation, test your senders’ deliverability with a real inbox placement tool. MailTester’s inbox tester sends real emails to major providers and shows actual inbox placement rates. It’s a trusted way to see how your authenticated setup performs in practice.

Use the MailTester API to verify individual addresses and avoid sending to inactive or invalid ones. This reduces strain on your sending reputation. For bulk list cleaning, the email list verification tool checks thousands of addresses with 98.9% accuracy.

Step-by-step: Set up DKIM for Brevo SMTP relay

You can set up DKIM for Brevo SMTP relay by navigating to Email > Authentication in your Brevo dashboard, selecting your domain, generating a DKIM key, then adding the full TXT record to your DNS provider. This proves your domain owns the email-sending service, which helps protect your sender reputation and improves inbox placement. The process takes about 5 minutes to complete and requires no changes to your email client.

Generate and copy the DKIM record in Brevo

1. Log into your Brevo account and go to Brevo’s app dashboard.
2. Navigate to Email > Authentication.
3. Select the domain you want to authenticate from the list.
4. Click Generate DKIM key. Brevo will create a unique signature key pair for your domain.
5. Copy the full TXT record string exactly as shown. It includes the selector (like brevo._domainkey) and the key value. This string is your authentication proof.

Add the DKIM record to your DNS provider

6. Go to your domain’s DNS provider (e.g., Cloudflare, GoDaddy, Namecheap, AWS Route 53).
7. Create a new TXT record.
8. Set the name (or host) field to your selector, e.g., brevo._domainkey.yourdomain.com.
9. Paste the full value (the string with the key) into the value field.
10. Save the record. DNS changes take time to propagate across the internet.
11. Wait 1–6 hours for propagation before checking. You can verify the record using tools like MXToolbox or RFC 6376, which defines DKIM’s technical framework.

Once propagated, Brevo will validate the record and use it to sign every outbound email. This cryptographic signature confirms each message was sent from an authorized source. If the signature fails, receivers may flag it as suspicious. You can test your setup with an inbox placement tool like MailTester’s Inbox Tester to verify delivery and inbox placement.

DKIM is one part of a larger email authentication strategy. For full protection, pair it with properly configured SPF and DMARC records. Misconfigured SPF can cause emails to be rejected, while DMARC policies tell receivers what to do with failed authentication attempts. Using a service like MailTester’s bulk verification to validate your email list before sending helps maintain a strong sender reputation. You can also add automation with the MailTester API across your workflows.

Step-by-step: Configure DMARC for Brevo SMTP relay

You set up DMARC by creating a TXT record in your DNS with name _dmarc and value v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1. This enables email monitoring without blocking delivery. Once you confirm emails arrive correctly in inboxes, you can tighten policies to p=quarantine or p=reject.

How your DMARC record works

DMARC uses DNS to define how receivers should handle emails that fail SPF or DKIM checks. The p=none policy means no action is taken — your emails keep going through, but you start getting reports. This is the safest first step when integrating with a service like Brevo.

Step-by-step setup

1. Log in to your DNS provider — this could be Cloudflare, GoDaddy, AWS Route 53, or another domain registrar with DNS management.
2. Create a new TXT record with the name _dmarc. This is a standard, case-sensitive label required by DMARC's specification.
3. Set the value to v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1. Replace yourdomain.com with your actual domain name.
4. Save the record. DNS changes can take up to 48 hours to propagate, but usually appear within a few hours.
5. Wait and monitor — use a tool like Postmark's DMARC guide or RFC 7483 to validate setup and review reports.

Once you see consistent inbox placement for emails sent via Brevo, you can gradually tighten the policy. Switch p=none to p=quarantine first — this marks suspicious emails as potentially spam. After confirming no legitimate emails are caught, move to p=reject for full enforcement.

A note on reporting: The rua and ruf tags direct DMARC reports to specific email addresses. Use dedicated addresses like [email protected] and [email protected] to avoid cluttering your inbox and to maintain clear visibility into deliverability health.

Pro tip: If you're unsure whether the correct DMARC policy is in place, verify your domain’s full email authentication stack using a real-time validator. MailTester’s inbox placement tester checks SPF, DKIM, and DMARC alignment across real inbox providers, so you can see exactly how your messages will be treated in Gmail, Outlook, and others.

What happens if you skip or misconfigure SPF, DKIM, or DMARC?

You’ll likely see emails rejected, marked as spam, or blocked by major inboxes like Gmail or Outlook. Without proper SPF, DKIM, and DMARC, your messages lack verifiable identity, leading to poor deliverability, high bounce rates, and a damaged sender reputation—especially when sending across multiple domains. Let’s break down what goes wrong when you skip these core email authentication standards.

Common consequences of ignored or faulty authentication

• Messages may be rejected at the SMTP level by receiving servers, especially if SPF fails or isn't published.
• Without DKIM signing, the receiving server can’t verify the message wasn’t tampered with during transit.
• Missing or poorly configured DMARC policies mean no enforcement of authentication, allowing spoofing and increasing the chance of your emails being flagged as suspicious.
• Gmail and Outlook use sender reputation signals in real-time—misconfigurations can trigger automatic filtering, even for legitimate senders.
• When multiple domains send via Brevo SMTP without proper setup, reputation degradation happens faster, due to inconsistent or unverifiable source identities.

How these failures translate to real-world outcomes

• High bounce rates become predictable: receiving servers reject invalid or unauthenticated emails without a second chance.
• Inbox placement drops: even if messages arrive, they land in spam or promotions tabs, reducing engagement.
• Reputation risks multiply quickly—every unverified or rejected email contributes to a negative signal that is hard to reverse.
• Tools like Spamhaus or MxToolbox track and report on such failures—once you’re listed, recovery can take weeks.
• Without proper authentication, your domain’s trust score drops, and future sends are more likely to be throttled or blocked.

According to RFC 7001, the presence of valid SPF, DKIM, and DMARC is widely recognized as a baseline for email integrity.

Even if you’re using Brevo’s SMTP relay correctly, skipping authentication is like driving without a license: you might make it a few miles, but sooner or later, you’ll be stopped.

Before you send bulk campaigns or transactional messages through Brevo, validate your setup. Use tools like MailTester’s inbox placement tester to verify how your messages land in real inboxes.

For teams managing large lists, bulk verification ensures only valid, authenticatable addresses are used—so your authentication doesn’t fail on poor data. Pair that with our real-time verification API to catch issues at the point of entry.

Authentication isn’t optional. It’s a foundation. Use it correctly—or face declining deliverability, blocked emails, and weakened trust.

How to verify SPF, DKIM, and DMARC are working correctly

You can confirm SPF, DKIM, and DMARC are working by checking your DNS records with a tool like MxToolbox, sending a test email, and inspecting the headers for SPFPASS, DKIMPASS, and DMARCPASS. If any of these signals are missing or show fail, your email isn’t being authenticated properly—this will hurt deliverability and increase spam flagging. Fixing it early prevents bounces and blacklisting.

Step-by-step verification process

1. Check your DNS TXT records using a public lookup tool. Use MxToolbox or Google’s Admin Toolbox to verify SPF, DKIM, and DMARC records are published and correctly formatted. A missing or malformed TXT record is a common reason authentication fails. These tools are industry-standard and trusted by email operators.
2. Send a test email via your Brevo SMTP relay. Use a known inbox (e.g., Gmail, Outlook) to send a test message. Avoid internal mailboxes or automated tools—use a real, monitored account so you can inspect headers without interference.
3. Inspect the full email headers using a header analyzer. Tools like MailTester’s inbox placement tester let you upload or paste the raw email headers. Look for three key lines: SPFPASS, DKIMPASS, and DMARC in the Authentication-Results section. Each passing signal confirms a valid authentication step.
4. Fix any failed signals before sending to live users. If you see SPFFAIL or DKIMFAIL, recheck your DNS entries. A misconfigured DKIM selector, incorrect SPF include, or mismatched domain in DMARC can cause this. Even one failure breaks the chain—reputable providers like Gmail treat it as a red flag.
5. Validate with a real inbox test. Use MailTester’s inbox verification tool to simulate delivery across major email providers. This reveals how your authenticated setup performs in practice—not just in theory. It checks headers, inbox placement, and spam flags in one go. Try it free.

Why authentication matters in practice

Even if your SPF, DKIM, and DMARC records are published, they only count if they’re correctly aligned and signed. Misalignment—like using a different domain in DKIM than in the From address—leads to failure. According to RFC 7672 (the standard for DMARC), alignment is required for a DMARC policy to apply. Without it, your emails are more likely to be quarantined or rejected.

Let’s be clear: authentication isn’t a checkbox. It’s a continuous check. A single typo in a TXT record can break the entire chain. That’s why you should verify every time you update DNS, especially after switching providers or migrating domains.

How does email verification help prevent SMTP relay issues?

Validating your email list before sending prevents invalid addresses from triggering bounces, which can damage sender reputation and trigger SMTP relay blocks. MailTester identifies catch-all, role-based, disposable, and outright invalid addresses before they hit your send queue. This reduces bounce rates and improves inbox placement, especially when paired with proper SPF, DKIM, and DMARC setup.

Real-world impact: Bounces and reputation

Every hard bounce from your Brevo SMTP relay — whether from a typo, closed account, or non-existent domain — counts against your sender reputation. High bounce rates signal poor list hygiene to email providers, increasing the chance your messages end up in spam folders or get blocked outright. According to industry standards, consistently exceeding a 0.5% bounce rate can flag your domain as unreliable (see RFC 6654, Section 4.3).

Preemptive filtering with MailTester

Let's be clear: you can't fix a bad list by sending more emails. Instead, use MailTester’s bulk verification to clean your entire subscriber base before the first campaign. It flags catch-alls — addresses that accept all mail but never reach a real user — as well as disposable email domains, role accounts (like sales@ or support@), and invalid formats. You can run this on a list of 10,000 contacts in minutes. Then, for automated campaigns, integrate the real-time API to verify each new sign-up as it comes in. See how it works: MailTester’s Verification API.

Combining clean data with strong authentication is critical. SPF, DKIM, and DMARC don’t prevent bounces — they help email providers trust your sender identity. But even the strongest authentication can’t save a campaign built on invalid addresses. If your Brevo SMTP relay sends to a high percentage of fake addresses, providers see that as abuse behavior, even if your DNS records are perfect.

If you're using Brevo’s email service with SMTP relay, you’ve already taken the first step. Now take the next: ensure every email sent is valid and deliverable. Test your real deliverability risk with MailTester’s Inbox Placement tester before sending to large lists. This isn’t just about avoiding bounces — it’s about maintaining the trust that keeps your messages in inboxes, not junk folders.

Use MailTester to validate your email list today, before your next send. It’s fast, accurate, and backed by the same standards that govern global email deliverability. The first validation is free: start with 100 free credits.

Why Brevo DKIM setup is not enough — you need full domain authentication

You can set up DKIM in Brevo, but that alone doesn’t prove your domain is trusted. DKIM only confirms an email wasn’t altered in transit. Without SPF and DMARC, your sender reputation remains at risk, and your messages may still be rejected or marked as spam. SPF validates the sending server; DMARC enforces that both SPF and DKIM are properly aligned. Skip any part, and you leave your outbound email exposed.

DKIM is not authentication — it’s integrity

DKIM signs your email’s content, ensuring it hasn’t been tampered with since leaving your server. But it does nothing to confirm that the server sending the email is authorized to represent your domain. That’s why DKIM alone is insufficient. A malicious actor could still spoof your domain if SPF and DMARC aren’t enforced.

SPF (Sender Policy Framework) explicitly authorizes which mail servers can send email on behalf of your domain. If you send from Brevo but don’t publish a correct SPF record, receiving servers have no way of knowing you’re allowed to send. This opens the door to rejection, especially as large providers like Gmail and Outlook increasingly enforce strict SPF checks.

DMARC ties it all together — and enforces policy

DMARC builds on SPF and DKIM by setting a policy: what should receiving servers do if either check fails? You can configure DMARC to monitor, quarantine, or reject unauthenticated messages. Without DMARC, there’s no enforcement — even if SPF and DKIM are correct, there’s no system to act on their results.

Even with perfect DKIM, if SPF is missing or misconfigured, your email may still end up in spam folders. This is commonly seen in large-scale campaigns where senders overlook SPF alignment. In practice, DMARC reporting helps you track failures and adjust configurations before they damage your deliverability.

For teams managing high-volume email, real-time verification is critical. You can test how your domain authentication performs across major inboxes using tools like MailTester’s inbox placement checker: inbox placement testing. It simulates how messages land across Gmail, Yahoo, and others, revealing whether SPF, DKIM, and DMARC are properly aligned.

Understanding these protocols isn’t optional. It’s how you prevent deliverability drops and stop spammers from using your domain. The RFCs define this clearly: SPF, DKIM, and DMARC are not a choice but a standard (see SPF spec, DKIM spec, DMARC spec). If you’re only setting up DKIM, you’re only doing half the job.

How MailTester helps fix deliverability issues post-setup

You don’t need to guess if your Brevo SMTP relay is delivering properly. MailTester stops bounces, spam flags, and sender reputation damage before they start. Run real-time checks at signup, clean old lists with bulk verification, test inbox placement with real inboxes, and trust that 98.9% accuracy on every result—no expired credits, no surprise costs.

Start with clean data—before the first send

• Use MailTester’s real-time verification API to validate every email at point of entry—stop invalid addresses from ever reaching your Brevo SMTP relay.
• Run bulk list verification on existing contacts via our bulk verification tool to remove invalid, catch-all, and risky addresses before any campaign.
• Test actual inbox placement with our inbox tester—send test messages to real inboxes and see if they land in inbox, spam, or quarantine, using real SMTP servers and filtering logic.

Build confidence with accurate, measurable results

• Each email verdict—valid, invalid, catch-all, or risky—is backed by 98.9% accuracy based on real-time checks against DNS, SMTP, and behavioral signals.
• Know the difference: a catch-all address may accept mail but won’t deliver it; a risky address may pass checks but has a high bounce or spam rate.
• Integrate with your workflow using our pre-built integrations (Mailchimp, HubSpot, Klaviyo, SendGrid) or use the API for custom apps.
• Start with 100 free credits—no time limit on purchased credits, so you can scale without worrying about expiring balances or budget surprises.

Deliverability isn’t just about authentication—it’s about consistency, data hygiene, and real inbox feedback. Use tools that reflect actual delivery outcomes, not just internal scores.

Conclusion: Set up Brevo SMTP relay with authentication and verification

SPF, DKIM, and DMARC are not optional. They are foundational to email authentication and required for consistent inbox placement.

Even with proper DNS configuration, sending to poor-quality lists can still harm your sender reputation. Clean data is just as important as proper setup.

Combining Brevo’s SMTP relay with real-time email verification—like using MailTester—catches invalid, disposable, and role-based addresses before they are sent, reducing bounces and protecting your deliverability.

Sources

• Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
• The number of top domains at DMARC enforcement grew from 233,249 in 2023 to 411,935 in 2026 — a 77% increase driven largely by mailbox-provider sender mandates. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)

Keep reading

• Email authentication: SPF, DKIM, DMARC, BIMI and MTA-STS (complete guide)
• Why SPF Include Still Fails DMARC Alignment in 2026
• ARC Headers Explained: ARC-SEAL and ARC-Authentication-Results
• Outlook Junk Placement After DMARC Policy Change in 2026
• 550 5.7.1 DMARC Reject Explained: Fix Bounces Now

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use Brevo SMTP without SPF and DKIM?

You can, but emails are likely to be rejected or marked as spam by major inboxes like Gmail and Outlook. Authentication is required for reliable deliverability.

How long does DNS propagation take for SPF and DKIM?

Typically 1 to 24 hours, depending on your DNS provider and TTL settings. Some changes apply within minutes.

Why is DMARC important if SPF and DKIM are working?

DMARC provides policy enforcement and reporting. Without it, you cannot act on failed authentications or monitor spoofing attempts.

Can a catch-all email pass DMARC?

Yes — a catch-all email may pass SPF and DKIM but still fail DMARC if the sender is not authorized. Such addresses are still risky.

Does MailTester test deliverability to real inboxes?

Yes — MailTester’s inbox placement test sends messages to real user inboxes across Gmail, Outlook, Yahoo, and other providers to measure actual placement.

What are the risks of using incorrect DKIM selectors in Brevo?

Using an incorrect or outdated selector will cause DKIM verification to fail. This results in lower trust and higher spam scores.

How do disposable domains affect sender reputation?

Sending to disposable domains increases risk of blacklisting and damages sender reputation, especially if done at scale.

Can I use MailTester with Brevo's SMTP relay?

Yes — use MailTester’s real-time API to verify addresses before sending via Brevo SMTP, or run bulk checks on entire lists to remove invalid entries.

How accurate is MailTester’s email verification?

MailTester has a 98.9% accuracy rate across millions of validations. It identifies valid, invalid, catch-all, and risky addresses with high reliability.

Do MailTester credits expire?

No — purchased credits never expire. You get 100 free verifications to start, with no time limit on using them.