Why Your Brevo Emails Fail DMARC Even When SPF Passes

You set up Brevo to send email from your custom domain. You added the SPF record. DKIM verifies. Your DNS looks correct. But your emails land in the Gmail spam folder, and your DMARC reports show alignment failures.

SPF passes. DKIM verifies. But DMARC fails.

This is not a DNS propagation problem. It is an alignment problem, and it is built into how Brevo sends email by default.

Why SPF passing does not mean DMARC passing

SPF and DMARC check different things.

SPF validates the envelope sender, which is the domain used in the RFC5321.MailFrom command during the SMTP conversation. This is also called the bounce address. The SPF record that Brevo gave you to add to your DNS authorizes Brevo's servers to send for your domain. That check passes.

DMARC adds a second requirement: alignment. For DMARC to pass, the domain that SPF validates must also match the domain in the RFC5322.From header, which is the From address your recipients see.

When these two domains do not match, you get a DMARC alignment failure, even when SPF technically passes.

This distinction trips up a lot of people who set up third-party sending platforms. The SPF record is correct. The DKIM signature is present. But the envelope domain is not the same as the header from domain, and DMARC requires both to align.

How Brevo sends email by default

Brevo sends from multiple IP addresses and uses its own envelope domain by default, not your custom sending domain. The envelope MAIL FROM that Brevo's servers use looks like bounces@brevo.domain.com or a similar Brevo-controlled domain, not bounces@yourdomain.com.

Your SPF record authorizes Brevo's servers to send mail. That part works. But the domain in the envelope is Brevo's, not yours.

When the recipient's mail server receives the message and runs a DMARC check, it compares the envelope domain (Brevo's) against the header From domain (yourdomain.com). They do not match. DMARC alignment fails.

DKIM signing works the same way. Brevo signs the message with its own DKIM key, associated with Brevo's domain, not yourdomain.com. When the recipient server checks DKIM alignment, it compares the signing domain (Brevo's) against your header From domain (yourdomain.com). They do not match here either.

The result: both SPF and DKIM give you a pass at the authentication layer, but DMARC fails at the alignment layer because neither the envelope domain nor the DKIM signing domain belongs to you.

What your DMARC report shows

In your DMARC aggregate report, you see something like this for every message Brevo sends:

• SPF: pass (Brevo's servers are authorized)
• DKIM: pass (Brevo's signature is valid)
• DMARC result: fail (alignment check failed)

The failure reason is recorded as "SPF alignment" or "DKIM alignment" depending on which check the receiving server evaluated first. In both cases, the root cause is the same: Brevo's domains do not align with your header From domain.

If you are monitoring your DMARC reports in DMARCFlow, this pattern is visible immediately. You see SPF passes and DKIM passes contradicted by DMARC failures, all from Brevo's sending infrastructure. DMARCFlow reports show the specific authentication result for each alignment mode, so you can tell whether the problem is SPF alignment, DKIM alignment, or both.

How to fix it

There are two paths to Brevo DMARC alignment, depending on your Brevo plan and configuration.

Option 1: Get DKIM alignment to pass

When you set up your Brevo sending domain, you publish DNS records that allow Brevo to publish a DKIM key for yourdomain.com. If Brevo uses yourdomain.com as the DKIM signing domain (not Brevo's own domain), then the DKIM alignment check passes, because the DKIM signing domain matches your header From domain.

DMARC requires only one of SPF alignment or DKIM alignment to pass, not both. So if DKIM alignment passes, your DMARC policy of p=reject or p=quarantine is satisfied.

The practical issue: you need to verify in your DMARC reports which signing domain Brevo is actually using. Some Brevo configurations sign with the Brevo domain even when a custom sending domain is set up. If the DKIM signing domain is Brevo's rather than yours, alignment does not pass regardless of your DNS setup.

Option 2: Use a custom envelope domain

If your Brevo plan supports it, you can set a subdomain of your own domain as the envelope MAIL FROM domain in Brevo's sending settings. For example: bounce.yourdomain.com.

You then add an SPF record for that subdomain and verify DKIM signing for it. When Brevo sends email, the envelope MAIL FROM is now bounce.yourdomain.com, which is your domain. SPF alignment passes because the envelope domain matches the header From domain.

This is the cleanest fix because it resolves SPF alignment directly. However, custom envelope domain support varies by Brevo plan, and not all accounts have access to this setting.

Option 3: Adjust your DMARC policy

If neither alignment option is available, changing your DMARC policy from p=reject to p=quarantine reduces the severity of the failure. Gmail and other providers may deliver the message to spam rather than rejecting it outright. This does not solve the underlying problem, and deliverability is still degraded, but it prevents a complete hard bounce.

This is a temporary measure while you work with Brevo support to enable custom DKIM signing for your domain or access custom envelope domain settings.

How to verify the fix worked

After changing your Brevo configuration, check your DMARC reports within 24 to 48 hours. In a properly aligned setup, you should see:

• SPF alignment: pass (or DKIM alignment: pass, if relying on DKIM only)
• DMARC result: pass

The specific indicators to look for in your DMARC XML report are in the <auth_results> section. Both <spf> and <dkim> entries should show <domain> values that match your header From domain (or a subdomain of it).

DMARCFlow parses these automatically and shows the alignment status for each authentication mechanism, so you can confirm the fix without reading raw XML.

How DMARCFlow helps

If you are sending through Brevo with a custom domain and you are not monitoring your DMARC reports, you may not know that alignment failures are happening until a customer reports their email landed in spam. DMARCFlow surfaces these failures as soon as they appear in your aggregate reports, showing you which sending platform is causing the misalignment and whether it is an SPF alignment problem, a DKIM alignment problem, or both.

For managed service providers who configure Brevo or similar platforms for multiple clients, DMARCFlow gives each client their own DMARC monitoring view, so you can identify Brevo alignment problems across your entire client base and confirm fixes without waiting for user complaints.

FAQ

Q: Does Brevo sign DKIM for my custom domain?

A: Brevo supports DKIM signing for custom sending domains. When you add your domain in Brevo's settings and publish the required DNS records, Brevo should DKIM sign with your domain. If that is working correctly, DKIM alignment will pass even if SPF alignment does not. Check your DMARC report to confirm whether Brevo's DKIM signing domain matches your header From domain. If it shows Brevo's domain rather than yours, the DKIM configuration is not complete.

Q: My SPF record is correct. Why does DMARC still fail?

A: SPF validates the envelope domain (RFC5321.MailFrom), not the header From domain. If Brevo uses its own envelope domain rather than your custom domain, SPF passes because Brevo's servers are authorized, but DMARC alignment fails because the envelope domain does not match your header From domain. This is the most common cause of DMARC failures with third-party sending platforms, and it is not visible from DNS checks alone.

Q: How do I read my DMARC report to confirm Brevo is causing alignment failures?

A: In your DMARC aggregate report, look at the <auth_results> section for each message. If SPF shows pass but the <spf> domain is brevo.com or a Brevo subdomain rather than yourdomain.com, that is an SPF alignment failure. If DKIM shows pass but the <dkim> domain is also Brevo's domain rather than yours, that is a DKIM alignment failure. DMARCFlow parses these automatically and flags the specific alignment mode that is failing for each sending source.