How to Set Up DKIM for Brevo (Sendinblue)

Brevo (formerly Sendinblue) sends marketing campaigns, transactional emails, and automated workflows on your behalf. Every time a subscriber receives a newsletter or a customer gets an order confirmation from your Brevo account, that message leaves Brevo's servers claiming to be from your domain. Without DKIM (DomainKeys Identified Mail) authentication, receiving mail servers have no way to verify that claim, and your emails are far more likely to end up in spam.

Why DKIM Matters for Brevo

Brevo uses shared sending infrastructure. That means your emails go out from the same IP addresses used by thousands of other Brevo customers. If one of those senders has poor practices, it can affect everyone on that shared pool. DKIM helps you stand apart from the crowd by cryptographically signing every message with a key tied to your domain.

Without DKIM, your Brevo campaigns face several problems:

• Emails may display "via sendinblue.com" or "via brevo.com" in recipient inboxes
• Gmail, Yahoo, and Microsoft apply stricter spam filtering to unsigned messages
• Your domain cannot build its own independent sender reputation
• You fail to meet the bulk sender requirements Google and Yahoo now enforce

With DKIM configured, each message carries a digital signature that proves it was authorized by you and hasn't been altered in transit. This improves inbox placement and builds your domain's reputation over time.

Before You Start

You will need three things:

• A Brevo account (free or paid plan)
• Access to your domain's DNS settings (through your registrar or hosting provider)
• Your sending domain already added in Brevo

The entire process takes about 10 to 15 minutes of active work, plus some waiting time for DNS propagation.

Setting Up DKIM in Brevo

Understanding Brevo's DNS Records

Brevo provides multiple records at once during domain authentication. Here is what each one does:

While all records are important, DKIM is the most critical for message integrity and deliverability. Add all the records Brevo recommends, but make sure DKIM is correct before anything else.

Verify Your DKIM Record

After Brevo confirms authentication, use an independent tool to verify the record is publicly resolvable. Enter your domain with the selector Brevo provided.

Testing Your Setup

Once verification passes, send a test campaign or transactional email from Brevo to an email account you control. Open the message and inspect the email headers. Look for these indicators:

• Authentication-Results should include dkim=pass
• The DKIM-Signature header should show d=yourdomain.com
• There should be no "via sendinblue.com" label next to your sender name

If you see dkim=fail or no DKIM header at all, double-check the DNS record values match exactly what Brevo provided.

Common Issues

Record not verifying after adding DNS

The most common cause is propagation delay. Wait at least 30 minutes before troubleshooting. If it still fails after a few hours, check that the host field does not include your full domain (most DNS providers append it automatically, so entering mail._domainkey.yourdomain.com creates a double entry).

Old Sendinblue selector vs. new Brevo selector

Multiple sending domains

If you send from more than one domain in Brevo (for example, a main business domain and a separate domain for transactional email), each domain needs its own DKIM record. Repeat the setup process for every sending domain listed in your account.

DKIM passes but emails still land in spam

DKIM alone does not guarantee inbox placement. If your messages pass DKIM but still get filtered, check your SPF record and DMARC policy. Also review your sending practices: list hygiene, engagement rates, and content quality all affect deliverability alongside authentication.

Complete Your Authentication

DKIM is one part of a three-layer authentication system. For the best results with Brevo, configure all three:

SPF (Sender Policy Framework) authorizes Brevo's servers to send on behalf of your domain. Add include:spf.sendinblue.com to your SPF record and verify it at spfrecordcheck.com.

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM checks fail. Start with a monitoring policy and work toward enforcement. Check your DMARC record at dmarcrecordchecker.com.

If you need to generate custom DKIM keys for services beyond Brevo, dkimcreator.com can create key pairs for any domain.

For ongoing monitoring across all your authentication records, deliverabilitychecker.com tracks your DNS daily and alerts you when something changes or breaks.

Monitor Your DKIM Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.