DKIM for Brevo: Domain Authentication Setup Guide

This guide is part of our Marketing and CRM series.

If your emails sent through Brevo are landing in spam folders or being flagged by inbox providers, missing domain authentication is the most likely culprit. DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send, proving it actually came from your domain and wasn't altered along the way. Without DKIM, providers like Gmail, Outlook, and Yahoo have no reliable way to trust your messages. Brevo - formerly known as Sendinblue until the rebrand in 2023 - includes a built-in domain authentication feature that walks you through DKIM setup, but you still need to add DNS records on your end. This guide covers every step.

Brevo handles DKIM through its domain authentication settings. When you authenticate a domain, Brevo generates a DKIM key and provides a TXT record for your DNS. Brevo also provides SPF and DMARC records during the same process. You don't need to generate DKIM keys yourself for standard Brevo email authentication.

How Brevo DKIM Works

Brevo takes a straightforward approach to DKIM. Unlike some services that use CNAME records pointing to provider-managed keys, Brevo gives you an actual TXT record containing the public key. Here's how the process works:

You start the domain authentication process in your Brevo account settings
Brevo generates a DKIM key pair and gives you a TXT record with the public key
You add that TXT record to your domain's DNS
You click "Authenticate" in Brevo to verify the record is in place
Brevo signs all outgoing emails from that domain with DKIM

The DKIM record Brevo provides uses the selector mail, so the full record name follows the format mail._domainkey.yourdomain.com. This is the address receiving mail servers use to look up your public key when they receive an email signed by Brevo.

Setting Up DKIM in Brevo

Open domain settings in Brevo

Log in to your Brevo account. Navigate to Settings > Senders, Domains & Dedicated IPs > Domains. Click Add a Domain if you haven't added your sending domain yet. If your domain is already listed, click on it to view the authentication records.

Enter your sending domain

Type the domain you use in your From address (e.g., example.com). This should match the domain your recipients see when they receive your emails. Brevo will generate all the DNS records you need based on this domain.

Copy the DNS records

Brevo displays three DNS records: a TXT record for DKIM, a TXT record for SPF, and a TXT record for DMARC. Copy all three records - you need all of them for complete domain authentication. The DKIM record will have the hostname mail._domainkey and a value starting with v=DKIM1;.

Add the records to your DNS

Log in to your DNS provider (GoDaddy, Cloudflare, Namecheap, etc.) and create the TXT records exactly as Brevo shows them. Pay close attention to the hostnames - some DNS providers automatically append your root domain, which can create a duplicate like mail._domainkey.example.com.example.com. If your provider does this, enter only mail._domainkey without the domain suffix.

Authenticate in Brevo

Return to the Brevo domain settings page and click Authenticate. Brevo checks your DNS for the records you added. If everything is correct, your domain status changes to authenticated. DNS propagation typically takes a few minutes to a few hours, though it can take up to 48 hours in rare cases.

Brevo DNS Records

When you authenticate a domain, Brevo provides three TXT records. The DKIM record follows this pattern:

Field	Value
Type	TXT
Host / Name	`mail._domainkey`
Value	`v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY`
TTL	Default or 3600

Brevo also provides TXT records for SPF and DMARC. While this guide focuses on DKIM, you should add all three records to complete your domain authentication. SPF tells receiving servers which mail servers are allowed to send on your behalf, and DMARC defines what happens when authentication checks fail.

The DKIM public key value is unique to your Brevo account. Always copy it directly from the Brevo domain settings page - never use values from examples or other documentation. Even a single missing or extra character will cause DKIM verification to fail.

Need DKIM keys for other services?

Generate DKIM key pairs for email services that require custom key configuration beyond automated setup.

Generate DKIM Keys

Shared vs. Dedicated IPs in Brevo

Brevo offers both shared and dedicated IP addresses for sending email. This affects your email deliverability, but it doesn't change how DKIM works. Whether you're on a shared or dedicated IP, your DKIM setup is the same - the authentication is tied to your domain, not your IP address.

That said, the distinction matters for your overall sending reputation:

Factor	Shared IP	Dedicated IP
IP reputation	Shared with other Brevo senders	Yours alone to build and maintain
Best for	Small to mid-size senders	High-volume senders (100k+ emails/month)
DKIM setup	Same process	Same process
Warm-up needed	No	Yes - gradual volume increase required

Most small and mid-size businesses do well on Brevo's shared IPs. Dedicated IPs make sense once you're sending at high volumes consistently and want full control over your sender reputation. Regardless of which option you choose, DKIM authentication is essential.

Using Brevo with Other Email Services

Most businesses use multiple email services - Brevo for marketing campaigns, Google Workspace or Microsoft 365 for daily communication, and perhaps a transactional service for order confirmations. Each of these can have its own DKIM configuration on the same domain without any conflicts.

DKIM selectors make this possible. Each service uses a unique selector, so receiving mail servers know which public key to check for each incoming email:

Service	Typical Selector
Brevo	`mail._domainkey`
Google Workspace	`google._domainkey`
Microsoft 365	`selector1._domainkey` / `selector2._domainkey`
SendGrid	`s1._domainkey` / `s2._domainkey`

Simply add all the DNS records from each service. They coexist without issues because they use different selector names. If you're managing DKIM across several services, keep a record of which selectors belong to which service so you don't accidentally remove the wrong one later.

Troubleshooting Brevo DKIM

Authentication fails when you click "Authenticate"

Confirm the TXT record is added to the correct DNS zone for your domain
Check that the hostname doesn't include your root domain twice (a common issue when DNS providers auto-append the domain)
Wait at least an hour for DNS propagation before trying again

DKIM was working but stopped passing

Verify the TXT record is still present in your DNS - it may have been accidentally removed during a DNS migration or cleanup
Check that the record value hasn't been truncated, which can happen if your DNS provider has character limits on TXT records
If you recently changed DNS providers, make sure the DKIM record was recreated at the new provider

Emails still landing in spam after DKIM is set up

DKIM alone doesn't guarantee inbox placement - make sure your SPF and DMARC records are also in place
Check your Brevo sending reputation and email engagement metrics
Verify that your From address domain matches the authenticated domain exactly
For new domains, inbox providers may need several weeks of consistent, engaged sending to build trust

Still seeing "Sendinblue" references in headers

Some older Brevo accounts may still show Sendinblue references in email headers. This doesn't affect DKIM authentication. The rebranding is cosmetic and doesn't change how email signing works.

References

RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
Brevo official documentation — Domain authentication and DKIM setup

Setting up email authentication for Brevo or migrating from Sendinblue? Make sure DKIM is in place so your messages reach the inbox.

Generate DKIM keys instantly

Create DKIM key pairs for any email service. Free, secure, and generated in your browser.