Why doesn't Brevo offer full SPF alignment and how much does it impact deliverability?
Published 1 Jul 2025
Updated 20 Aug 2026
12 min read
Summarize with
Updated on 20 Aug 2026: We updated this guide for Brevo's branded-subdomain rollout and current SPF setup guidance.
Brevo's legacy or default shared-IP setup keeps the envelope sender, also called the Return-Path or SMTP MAIL FROM domain, under Brevo's infrastructure instead of your visible From domain. SPF then passes for Brevo's bounce domain, not your brand domain. Brevo is gradually rolling out a branded-subdomain setup that can put SPF and the Return-Path on your domain, so the current answer depends on which domain setup flow your account has.
The practical impact of missing SPF alignment is usually small when DKIM passes with your domain and DMARC passes through DKIM. An SPF alignment warning is not the same as a delivery failure or a spam-folder diagnosis. Delivery means the receiving server accepted the message, while deliverability is where the message lands after filtering. Treat the warning as a diagnostic signal, then check whether a branded subdomain is available before considering a dedicated IP.
- Direct answer: Older shared-IP setups use a Brevo bounce domain, while the new branded-subdomain flow can provide SPF alignment.
- Deliverability impact: Low when DKIM is valid, domain-matched, and DMARC passes.
- When it matters: It becomes a real issue when DKIM fails, DMARC fails, or reporting tools mark the source as unauthenticated.
- Best next step: Check headers, DKIM, DMARC reports, the Return-Path, and Brevo's domain settings before changing infrastructure.
The short answer
SPF alignment is a DMARC concept. It asks whether the domain that passed SPF matches the visible From domain. SPF itself can pass perfectly while SPF alignment fails. Under relaxed alignment, the domains can be different subdomains of the same organizational domain. Under strict alignment, they must match exactly. A provider-owned Brevo bounce domain does not match your From domain in either mode. That domain is visible in Authentication-Results as smtp.mailfrom and often appears in Return-Path after delivery.
DMARC does not require both SPF and DKIM to match the From domain. It requires at least one of them to pass and match. If Brevo signs with DKIM using your authenticated sending domain, DMARC can pass through DKIM even when SPF alignment is absent. That distinction separates a noisy warning from a real authentication failure. The separate concepts are easier to debug when you keep SPF authentication and alignment apart.
Typical legacy shared-IP resulttext
Authentication-Results: spf=pass smtp.mailfrom=mail123.sender-sib.com dkim=pass header.d=example.com dmarc=pass header.from=example.com Result: SPF passes, but SPF alignment is not present. DKIM passes and matches the From domain. DMARC passes.
The key question is not "does SPF match?" The key question is "does DMARC pass for the domain in the visible From address?" If yes, the SPF alignment warning deserves attention, but it does not automatically explain spam placement.
Why Brevo handles SPF this way
On legacy shared-IP setups, Brevo needs a predictable Return-Path domain so it can receive bounces, classify delivery responses, process suppressions, and protect shared infrastructure. Giving each customer a custom SMTP MAIL FROM domain, also called a custom MAIL FROM or custom Return-Path, requires more than a DNS toggle. It changes bounce routing, customer setup, monitoring, support, and failure handling.
A Brevo dedicated IP uses customer-domain DNS and gives the sender direct responsibility for IP reputation. That path can provide SPF alignment, but it is no longer the only documented path. Brevo's newer branded-subdomain setup can also move SPF and the Return-Path onto a customer subdomain while mail still uses shared IPs.
Older support discussions often point customers toward a dedicated IP for full SPF alignment because branded subdomains were not available in the earlier flow. A Brevo community thread documents that earlier limitation, so use it as historical context rather than current setup instructions.
Shared IP
Shared IP sending reduces the sender's infrastructure work. The legacy setup uses a provider-owned Return-Path, while eligible accounts can use a branded subdomain.
- Upside: Suitable for low or uneven volume, with no separate IP warm-up.
- Tradeoff: SPF remains provider-domain based unless the branded-subdomain setup is enabled.
Dedicated IP
Dedicated IP sending can use customer-domain infrastructure and puts reputation work on the sender, including warm-up and volume consistency.
- Upside: Direct IP reputation control and customer-domain SPF are available with the right configuration.
- Tradeoff: Low or inconsistent volume can make IP reputation unstable.
Brevo domain authentication settings for SPF, DKIM, DMARC, and dedicated IP setup.
A provider-owned Return-Path can look like a defect in your DNS even when your DNS is correct. Adding another include to your root SPF record does not force Brevo's legacy setup to use your domain in the Return-Path. The envelope sender must change, which is what the branded-subdomain or dedicated-IP configuration does.
How Brevo's branded subdomain changes the answer
Brevo now documents a branded subdomain in its new domain setup flow. The rollout is gradual, so it is not available to every account. When enabled, Brevo uses a subdomain of your sending domain for SPF and the Return-Path, as well as branded tracking and image links. This removes the older assumption that shared-IP sending must always use a Brevo-owned envelope domain.
For a visible From address at example.com and a Return-Path under mail.example.com, SPF matches under DMARC's default relaxed alignment because both share the organizational domain. It does not satisfy strict SPF alignment when aspf=s requires the domains to match exactly. Most senders use relaxed alignment, including with enforcement policies such as p=quarantine or p=reject.
- Open Brevo's domain settings and check whether the new guided setup or branded-subdomain option appears.
- Use a sending subdomain when practical, because Brevo supports managed delegation there and it separates sending reputation from the root domain.
- Publish only the DNS records Brevo generates for that domain, then verify smtp.mailfrom and Authentication-Results in a received message.
- If the option is absent, keep domain-matched DKIM and ask Brevo about account availability before buying a dedicated IP.
Brevo's current domain setup guidance says the branded-subdomain flow is still being rolled out. Account availability is therefore part of the diagnosis.
How much deliverability risk this creates
For normal marketing or transactional mail on Brevo shared IPs, missing SPF alignment creates modest risk if DKIM passes with your domain, DMARC passes, complaint rates are low, bounce rates are controlled, and the list is engaged. Mailbox providers care about authentication, but they also judge domain and IP reputation, engagement, complaints, bounces, list quality, content, sending consistency, and user feedback.
SPF alignment becomes more important when DKIM is unreliable. It also supplies a second independent DMARC path and clearer evidence during audits, migrations, and incident response. For a third-party sender, stable domain-matched DKIM still comes first. A branded Return-Path is the next improvement when your account supports it.
Risk by authentication result
Use this as a practical triage scale for Brevo shared-IP sending.
Low risk
DKIM pass
DKIM passes with your domain and DMARC passes.
Medium risk
Mixed DKIM
DKIM passes inconsistently or only some mail streams are signed.
High risk
DMARC fail
DKIM fails and SPF is not matched to the From domain.
Do not treat a dedicated IP as a universal fix. Brevo recommends one for senders running at least three campaigns a week to 3,000 or more contacts, or sending more than 100,000 emails a month. It needs warm-up, steady volume, and active reputation management. Low or inconsistent volume can produce thin reputation history and worse delivery consistency than a healthy shared pool.
- Mostly harmless: SPF is not matched, DKIM is matched, and DMARC passes across real inbox tests.
- Needs attention: Different campaign types show different DKIM domains or unsigned mail.
- Fix first: DMARC aggregate reports show Brevo volume failing DMARC.
- Watch closely: Inbox placement drops at the same time authentication failures rise.
What to check before changing anything
Start with the received message headers, not the dashboard warning. Send a real email to a mailbox you control, open the original message, and check SPF, DKIM, and DMARC results. Record which domain passed DKIM, which domain passed SPF, which domain appears in smtp.mailfrom, and which mechanism gave DMARC its pass.
Then check Brevo's Domains page. Look for the new guided domain setup and a branded subdomain before editing your root SPF record. Brevo's current standard authentication uses its verification code and the required DKIM and DMARC records. Its documentation says SPF and MX records are not required for standard domain authentication and are supplied for dedicated-IP setup.
If your domain already has an SPF record, check it for broken syntax, duplication, and the 10 DNS-querying-term limit. A broken root record can affect other senders that use your domain in the envelope sender. A focused SPF checker separates record problems from Brevo's Return-Path behavior.
Add include:spf.brevo.com and mx only when the DNS instructions for your Brevo account or dedicated IP explicitly require them. Merge them into the existing SPF record rather than publishing a second record. Keep one final all mechanism at the end.
An SPF include authorizes a sender for the domain where the record is evaluated, but it does not change a provider-owned SMTP MAIL FROM. Changing ~all to -all only changes the result for unauthorized IPs. It does not change the domain DMARC compares. Treat every SPF include as active sending permission, not as proof of DMARC alignment.
Publish only one SPF TXT record for a domain. Multiple SPF records return permerror, and oversized SPF answers can fail inconsistently depending on DNS transport and resolver behavior. Fixing those defects protects every mail stream that evaluates the record, but it does not change Brevo's envelope domain.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
For a broader view, run a domain health check and compare it with your DMARC aggregate reports. The important pattern is whether Brevo appears as a passing DKIM source and whether a branded Return-Path appears after setup.
Example DNS state when Brevo supplies SPFtext
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" example.com. TXT "v=spf1 include:spf.brevo.com mx ~all" selector._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=PUBLICKEY"
Suped's product is useful in this workflow because it groups DMARC, SPF, DKIM, blocklist (blacklist) monitoring, and deliverability signals in one place. The value is seeing whether the warning maps to a real DMARC failure, which source caused it, and what to fix next.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
Your practical options
There are five realistic paths. The right one depends on whether DMARC passes today, whether the branded-subdomain option is available, whether your volume supports a dedicated IP, and whether strict SPF alignment is a policy requirement. A dedicated IP is about reputation ownership and sending control, not simply removing a warning.
|
|
|
|---|---|---|
Stay shared | DKIM and DMARC pass | Legacy SPF warning remains |
Branded subdomain | Eligible shared-IP accounts | Gradual rollout |
Fix DKIM | DMARC gaps | Needs DNS access |
Dedicated IP | Steady high volume | Warm-up required |
Move provider | Strict setup requirements | Migration work |
Common choices for Brevo SPF alignment issues.
For most teams, first make DKIM and DMARC routine. Authenticate the sending domain, keep DKIM stable, collect DMARC reports, and stage policy changes. Suped's product supports that work by turning raw reports into source-level issues, alerts, and fix steps. When SPF complexity grows across multiple senders, Hosted SPF in Suped's product helps manage sender includes without constant DNS edits.
If Brevo is your only sender and DKIM passes cleanly, check for a branded subdomain before paying for a dedicated IP. Switching the SPF qualifier from ~all to -all will not make a provider-owned Return-Path match your domain. A dedicated IP becomes reasonable when volume is large and steady, IP reputation control matters, and you have a warm-up plan. If DMARC reports show Brevo failing because DKIM is missing or broken, fix that first.
Priority order
A simple way to rank fixes before spending money on infrastructure.
Do first
Do later
Avoid early
Views from the trenches
Best practices
Verify DKIM by message headers before acting on SPF alignment warnings in checkers.
Use DMARC reports to confirm whether Brevo traffic passes through DKIM at volume.
Keep low-volume senders on shared IPs unless there is a proven reputation reason.
Common pitfalls
Adding SPF includes does not change the Return-Path on Brevo's legacy shared-IP setup.
Buying a dedicated IP without enough volume can create unstable sender reputation.
Treating checker warnings as inbox placement proof leads to poor remediation work.
Expert tips
Prioritize domain-matched DKIM when Brevo's branded-subdomain option is unavailable to you.
Monitor failed DMARC sources, then decide whether SPF alignment deserves budget.
Ask providers whether custom SMTP MAIL FROM works on shared IPs before migration.
Marketer from Email Geeks says Brevo's shared-IP limitation is product work, not a DNS mistake, and custom SMTP MAIL FROM support changes the platform's bounce handling.
2025-02-24 - Email Geeks
Marketer from Email Geeks says SPF alignment is common as a concern, but domain-matched DKIM usually keeps DMARC passing for ESP mail.
2025-02-24 - Email Geeks
What to do next
Do not treat missing SPF alignment as an automatic deliverability problem. Prove the authentication path first. If DKIM passes with the From domain and DMARC passes in real mailbox headers and aggregate reports, the warning is usually a configuration limitation rather than the root cause of poor placement.
The sensible order is simple: validate DKIM, collect DMARC reports, check for Brevo's branded-subdomain option, confirm actual inbox symptoms, then decide whether a dedicated IP has enough volume to support it. Do not switch from ~all to -all as a workaround for a provider-owned Return-Path. Suped's product fits that order because it connects authentication failures, source identification, policy staging, real-time alerts, Hosted SPF, SPF flattening, and blocklist (blacklist) monitoring in one workflow.
For a sender with low or inconsistent volume, the default answer is: stay on shared IPs, make DKIM and DMARC clean, enable a branded subdomain if available, monitor results, and avoid dedicated-IP infrastructure solely to remove an SPF alignment warning.
