Why Your Brevo SPF/DKIM Alignment Fails (And How to Fix It)

Emails sent through Brevo are landing in the spam folder, or your DMARC reports show alignment failures for messages you sent through Brevo. The emails are not bouncing outright, but they are not reaching the inbox either, and your DMARC aggregate reports show failures that you do not know how to interpret.

The cause is almost always an SPF or DKIM alignment failure. Brevo sends from its own SMTP servers, which means authentication passes under Brevo's domain. But your From address shows your domain. DMARC requires those to match. When they do not, DMARC treats the message as untrusted.

This is not a Brevo problem. It is a configuration problem. And the fix is specific enough that it is worth walking through exactly what goes wrong and exactly how to fix it.

What Does SPF or DKIM Alignment Mean

DMARC alignment is the step that ties authentication results to your From address. It checks whether the domain that passed SPF or DKIM is the same domain your recipients see in their email client.

There are two types:

SPF alignment checks the RFC5321.Mailfrom domain (the envelope sender, visible to mail servers but not always to recipients) against the RFC5322.From domain (the From address shown in email clients).
DKIM alignment checks the domain in the DKIM signature header against the From address domain.

For a message to pass DMARC, at least one of SPF or DKIM must pass AND have its aligned domain match the From domain. The authentication check passing is not enough. The domains must also match.

Why Brevo Causes Alignment Failures

Brevo sends email from its own SMTP infrastructure. When you send through Brevo using a custom sending domain, the technical chain looks like this:

1. Your application calls Brevo's API with your message and your From address (for example, hello@example.com).
2. Brevo receives the message and injects it into its mail pipeline.
3. Brevo's SMTP servers connect to the recipient's mail server and submit the message with Brevo's own envelope-from domain (typically mx-relay.brevo.net or sendinblue.com).
4. The recipient server sees SPF pass for mx-relay.brevo.net.
5. The recipient server sees a DKIM signature from Brevo's domain.
6. The recipient server checks DMARC and finds: From header shows example.com, but SPF and DKIM authenticated under Brevo's domains. Alignment fails. DMARC fails.

The critical point is step 3. Brevo is a third-party sender. Its servers submit the message using Brevo's domain as the envelope sender, not yours. SPF passes. DKIM passes. But DMARC alignment fails because the authenticated domains do not match your From header domain.

The fix is to enable Brevo's Custom Domain Sending feature. This makes Brevo submit the message using your own domain as the envelope-from and sign with DKIM keys under your domain. That is what makes SPF and DKIM align with your From address.

Common Brevo SPF Alignment Mistakes

Mistake 1: Replacing Instead of Adding to Your SPF Record

If you already have an SPF record and then add Brevo, the instinct is to replace the old record with Brevo's record. That breaks email for every other service you use that sends through its own servers.

Your existing SPF record might look like:


v=spf1 include:_spf.google.com ~all

If you replace it with:


v=spf1 include:_spf.brevo.com ~all

Then Google Workspace mail from your own servers starts failing SPF because _spf.google.com is no longer included. You get new problems while fixing Brevo.

The correct approach is to add Brevo's include to your existing record:


v=spf1 include:_spf.google.com include:_spf.brevo.com ~all

This applies to any ESP you use. Each new sending service gets added via include:, never by replacing the entire record.

Mistake 2: Sending from a Subdomain But Authorizing Only the Root Domain

If your From address is newsletter@subdomain.example.com and your SPF record only covers example.com, SPF alignment fails. The envelope-from domain is newsletter@subdomain.example.com, which is a different domain than example.com. Your SPF record does not authorize subdomain.example.com to send.

Your SPF record must include the exact subdomain you send from. If you use multiple subdomains for different sending purposes, each one needs its own SPF record or a mechanism that explicitly covers them.

Mistake 3: Multiple SPF Records

Having more than one SPF record for a domain causes a permanent DNS lookup failure (permerror) for SPF checks. Some DNS dashboards create a second SPF record accidentally when you add a new service. Email providers treat permerror as an authentication failure, which means your legitimate email gets rejected or flagged.

Run dig TXT example.com and check for two or more v=spf1 records. If you find two, merge them into one.

Common Brevo DKIM Alignment Mistakes

Mistake 1: No DKIM Record Published

Brevo provides a DKIM TXT record that you must publish in your DNS. If you skipped this step or it did not complete, DKIM signatures are not applied to your messages. Without DKIM, your messages rely solely on SPF for authentication. Most DMARC policies that require DKIM will fail, and even policies that do not require DKIM still benefit from it as a secondary authentication mechanism.

Mistake 2: Publishing DKIM at the Wrong Domain

Brevo specifies a particular subdomain for DKIM publication. The record looks like:


brevo9._domainkey.subdomain.example.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA..."

This must be published at brevo9._domainkey.subdomain.example.com, not at _domainkey.example.com. If you publish it at the wrong subdomain, Brevo's DKIM signature will not validate because the receiving server looks up the selector domain and gets NXDOMAIN (domain does not exist).

Mistake 3: DKIM Selector Mismatch

When you configure DKIM in Brevo's dashboard, Brevo generates a DKIM selector and creates the DNS record for you to publish. The selector (for example Brevo9) is part of the record name and determines which public key the receiving server looks up. If you change the selector in the Brevo dashboard after publishing the DNS record, the keys no longer match and DKIM validation fails.

Do not change the selector after publishing. Use the selector Brevo generated and do not modify it.

Mistake 4: Not Waiting for DNS Propagation

DKIM TXT records can take up to 48 hours to propagate globally. If you test immediately after publishing and DKIM reports as fail, wait a full 48 hours before concluding there is a configuration problem.

How to Diagnose Brevo SPF and DKIM Alignment Issues

Step 1: Check Your DMARC Aggregate Reports

DMARC aggregate reports (sent to the ruf=mailto address in your DMARC record) show authentication results without exposing individual message content. Look for the section in each report entry.

A failure from Brevo will typically show one of these patterns:

DKIM signature present but dkimspecificresult=fail or dkimspecificresult=neutral -- the DKIM signature domain does not match your From domain
SPF pass with Alignment=fail in the DMARC result -- SPF authenticated but under a different domain than your From address
Both DKIM and SPF showing pass but DMARC result showing fail -- alignment is the missing piece

If you do not have DMARC reports set up, you are flying blind. DMARCFlow aggregates your DMARC reports and shows you per-sending-service authentication results, so you can see immediately when Brevo or any other ESP starts failing alignment. You can also set up alerts that fire when Brevo DKIM or SPF alignment failures cross a threshold you define.

Step 2: Verify Your Brevo SPF Record

Use a DNS lookup tool or run:


dig TXT _spf.brevo.com

If this returns a Brevo SPF record, Brevo's sending infrastructure has valid SPF records in DNS. This confirms Brevo's side of the setup. The problem is on your domain's configuration.

Step 3: Verify Your DKIM Record

In your Brevo dashboard under Sender Identities, find the DKIM selector assigned to your domain. Then run:


dig TXT brevo9._domainkey.subdomain.example.com

(Replace brevo9 and subdomain.example.com with your actual values.)

If the query returns your DKIM public key, the record is published and should validate. If it returns NXDOMAIN, the record is not published at that location or has not propagated yet.

Step 4: Confirm Custom Domain Sending Is Enabled

In your Brevo sending domain settings, confirm that Custom Domain Sending is enabled. Without this, Brevo submits messages using its own envelope domain regardless of your DNS configuration, and SPF alignment will fail no matter what.

Step-by-Step Fix for Brevo SPF and DKIM Alignment

Step 1: Log In to Brevo and Navigate to Sender Identities

Open Brevo, go to Sender Identities, and select the domain you want to configure for sending.

Step 2: Add Brevo's SPF Include to Your Existing SPF Record

Do not replace your existing SPF record. Find the current record for your root domain (or the subdomain you send from) and append the Brevo include. If your DNS provider shows your current SPF record as a separate editable field, add include:_spf.brevo.com to the existing content. If you see two separate SPF records, merge them.

Step 3: Publish the DKIM TXT Record at the Correct Subdomain

Brevo displays the exact DNS entry to publish, including the full subdomain name. Create a TXT record at exactly that subdomain with the provided value. Do not change the selector name. Do not publish it at a different subdomain.

Step 4: Enable Custom Domain Sending in Brevo

In your Brevo sending domain settings, enable Custom Domain Sending. This changes the envelope-from address from Brevo's default to your own domain, which makes SPF alignment pass. Without this step, Brevo submits messages using its own envelope domain, and SPF alignment will fail regardless of your DNS settings.

Step 5: Wait for DNS Propagation

Wait up to 48 hours for DKIM propagation. SPF changes typically propagate within minutes but can take a few hours in some cases.

Step 6: Verify Your Setup

After waiting, check your DMARC aggregate reports for Brevo-sent messages. You should see DKIM and SPF both passing with Alignment=pass. Once that is confirmed, you can move your DMARC policy to quarantine or reject without breaking legitimate Brevo email.

How DMARCFlow Helps Prevent Future Brevo Alignment Issues

Brevo DKIM and SPF alignment failures do not always produce immediate symptoms. Your emails may still reach inboxes for weeks before a DMARC policy upgrade causes sudden rejections. The only reliable way to catch alignment failures before they cause problems is to monitor your DMARC reports continuously.

DMARCFlow aggregates DMARC reports for your domains and shows you alignment failures per sending service. When Brevo DKIM stops validating or SPF alignment breaks, you see it within hours rather than discovering it when a customer complaint arrives. You can set up alerts for specific failure patterns so you know immediately when Brevo authentication degrades.

For teams managing multiple ESPs or planning DNS migrations, DMARCFlow also shows which domains are sending through which providers, making it easier to plan changes without breaking existing sending infrastructure.

FAQ

Q: Can I use Brevo with a subdomain?
A: Yes. Publish your DKIM record at the Brevo-designated subdomain (for example, brevo9._domainkey.subdomain.example.com) and make sure your SPF record covers the subdomain. Your From address must use the same subdomain. Brevo supports multiple subdomains with separate DKIM records for each.

Q: My Brevo SPF record is added but emails still fail. Why?
A: Run a DMARC report check to identify whether it is an SPF failure or a DKIM failure. Multiple SPF records cause permerror, which looks like an authentication failure even when individual records are correct. Also confirm that Custom Domain Sending is enabled in Brevo -- without it, Brevo uses its own envelope domain and SPF alignment will fail.

Q: How long does Brevo DKIM propagation take?
A: Usually within minutes, but some DNS providers cache TXT records for longer. The practical maximum is 48 hours. If DKIM fails after 48 hours, the record is either at the wrong subdomain or has the wrong value.

Q: Does Brevo support DKIM key rotation?
A: Brevo handles DKIM key rotation automatically. Admins do not need to regenerate DKIM keys manually.

Q: Can I send from multiple subdomains through Brevo?
A: Yes, but each subdomain needs its own DKIM record and its own sending domain configuration in Brevo. One DKIM record covers one subdomain only.

The Short Version

Brevo DKIM and SPF alignment failures come down to one root cause: Brevo sends under its own domain in the SMTP conversation, which does not match the From header domain your recipients see. The fix is Custom Domain Sending, which aligns the envelope-from with your From address, plus correct DKIM publication at the right subdomain.

DNS misconfigurations are the other common cause: overwriting an existing SPF record instead of adding to it, publishing DKIM at the wrong subdomain, or having multiple SPF records that cause permerror.

If you are migrating to Brevo or upgrading your DMARC policy, set up DMARC monitoring first so you can see authentication failures in real time rather than discovering them when a key customer stops receiving your emails. DMARCFlow gives you that visibility in one place, with alerts when alignment starts failing for any of your configured sending services.