Set up DMARC with Brevo

Brevo authenticates domains differently from most platforms, and the difference surprises people: neither SPF nor MX is required to authenticate a domain. They are only needed for a dedicated IP address.

What Brevo asks you to publish

From your account, in the sending domains section, Brevo displays the exact values to copy into your DNS zone: a Brevo code, a DKIM record, and a DMARC record if you do not have one yet. These values are specific to your account — they cannot be guessed or copied from a tutorial.

One distinction to keep in mind: the Brevo code proves that the domain is yours, it authenticates no message. A domain where only that code is published shows as « verified » in Brevo and keeps failing DMARC. DKIM does the work.

Allow up to 48 hours for full authentication to be recognised.

Why the absence of SPF is not a problem

DMARC is satisfied as soon as SPF or DKIM passes and aligns with the visible domain. Since Brevo sends with its own envelope address, an SPF record on your side would not change alignment: it is the DKIM signature, published on your domain, that makes the message compliant. Adding a Brevo include « just in case » consumes one of the ten permitted DNS lookups for nothing.

Your SPF record is of course still needed for your other senders — your mailbox provider, your billing tool, your scripts.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Stay there long enough to identify every legitimate sender before tightening. The progression, step by step.

Common mistakes with Brevo

• Stopping at the Brevo code. The domain is verified, the emails still fail DMARC.
• Adding a Brevo SPF include as a precaution: useless for alignment, and one fewer DNS lookup in an already tight budget.
• Publishing DMARC before DKIM. A strict policy published first will reject your own campaigns until authentication catches up.
• A sending subdomain left uncovered: the parent domain’s policy applies to subdomains unless sp= says otherwise, and a poorly authenticated sending subdomain falls with it.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge — without opening a single XML file.