For Brevo domain authentication, first identify the sending domain and the setup flow shown in your account. Then add the account-specific DNS records, verify the result and check a message before launching a campaign. Do not copy another business’s DNS values or replace an existing email configuration simply to clear a warning.
This guide is for a small business already setting up Brevo. If you are still choosing software, our Brevo vs Mailchimp comparison covers the wider platform decision.
Table of Contents
Choose the domain before editing DNS
Your sending domain is the part after the @ in the address used for outgoing messages. Brevo’s authentication FAQ says you must own and control it; you cannot authenticate gmail.com or another public email provider’s domain. Authenticate each domain you intend to send from.
Illustrative example: a consultancy wants its newsletter to come from updates@news.example.com. Write down news.example.com as the intended sending domain, alongside the person responsible for DNS and the inbox that should receive replies. Agree these details before anyone starts creating records.
Brevo’s domain-structure guidance distinguishes the sender domain, reply-to address and branded tracking subdomain. Its recommended shared-IP example authenticates the same subdomain used in the From address. Authenticating the root domain alone is not the same as authenticating the sending subdomain.
If you cannot locate the DNS account, Brevo explains how to use nameserver information in its provider identification guide. Confirm access with whoever manages your website and email. Save a copy of the current DNS settings and note which existing services use the domain.
Match the instructions to your Brevo screen
Brevo is gradually introducing a new domain setup flow. It combines authentication with branded-subdomain and dedicated-IP options. Start in Settings, then Senders, Domains, IPs, then Domains. A shared-IP user can skip branding; a dedicated-IP configuration has different requirements. Follow the choices shown for your account. The current new-flow instructions also specify a sending domain not already used on another platform or email service; settle that choice with your DNS owner.
The earlier authentication flow uses a Brevo code TXT record, DKIM as either one TXT record or two CNAME records, and a DMARC TXT record. The Brevo code proves domain control; DKIM signs messages; DMARC states how authentication failures should be handled. Use the record types and values your account supplies.
A mismatch between a tutorial’s screenshots and your account does not by itself mean the account is broken. Identify the flow first, then keep its official instructions open beside your DNS editor. Avoid assembling one configuration from several tutorials written for different versions.
Choose automatic setup or individual DNS records
In the new flow, individual records retain your DNS control. Managed setup delegates a subdomain through NS records and is unavailable for a root sending domain. Brevo warns that delegating the root would affect other services. Automatic entry is offered where supported; manual entry uses the displayed record names, types and values.
Our recommendation for a business with an established email setup is to have its DNS owner review the proposed changes first. Make a short change list: the exact domain, each proposed record, any conflict and the planned verification. That makes the work reviewable even when an agency performs it.
Both flows can offer to replace existing DMARC during automatic setup. Brevo’s authentication instructions direct users to manual setup if they want to retain the existing record. Keep the current policy under deliberate review; do not weaken it as a shortcut.
Check conflicts before saving
The following checks draw on Brevo’s authentication troubleshooting guide.
| What you see | What to check |
|---|---|
| Record not detected | Compare the public DNS result with the record supplied by Brevo, including its type and complete hostname. |
| Domain repeated in the hostname | Your provider may append the domain automatically. Check its required input format. |
| Multiple DMARC records | Have the DNS owner reconcile them into one valid policy for that domain, preserving the intended reporting configuration. |
| Existing DKIM conflict | Check whether another active service needs it. Ask Brevo support about an alternative rather than removing a working service’s record. |
Keep a note of each result. If authentication fails, one documented mismatch is more useful than repeatedly deleting and recreating the whole configuration.
Verify authentication and the actual sender
Use Brevo’s verification control after saving the records. The standard setup guide allows up to 48 hours for propagation and says to keep the records in place while using Brevo. Its statement that SPF and MX are unnecessary concerns that authentication setup; do not use it to discard records required by your mailbox provider or a different configuration.
Brevo’s sender guide treats From name and From email as separate settings. Senders on an authenticated domain are automatically verified. List-specific senders can override a campaign’s default, so check the sender used by the intended audience too.
Our suggested acceptance check is a small message to an address you control. Inspect the displayed sender, reply route, links and authentication results. Brevo’s email-header guide shows where to find the underlying message information. Record the outcome and the person responsible for maintaining the setup.
Authentication is not a guarantee of inbox placement; Brevo’s troubleshooting guidance makes that limitation explicit. If customer records also live in a sales system, our CRM with email marketing guide helps frame the wider hand-off. Finish the sending checks before adding that extra complexity.
Sources reviewed 19 September 2026. Based on official Brevo documentation; the consultancy example and acceptance checklist are illustrative recommendations.
