Authenticate a Hostsuar domain in Brevo

Brevo asks you to authenticate the sender domain to prove it can send on its behalf and to improve deliverability. To do this it generates several DNS records, usually for the Brevo code, DKIM and DMARC.

The names and values are specific to each account. Always copy the ones shown in Senders, Domains & Dedicated IPs in Brevo and do not reuse records from examples or from another domain.

Find the authoritative DNS zone

The records must be added where the public DNS is managed, which is not always the same as the website or email provider:

• With our DNS servers and a hosting plan, use cPanel's Zone Editor.
• For a domain that uses our zone tool without hosting, edit them from the domain's DNS options in the client area.
• If the DNS servers belong to Cloudflare or another provider, set them up there.

You can check the current DNS servers before editing. Creating the records in a zone that is not authoritative makes no public change, even if the panel saves them correctly.

Add the Brevo records

1. In Brevo, open the domain. If it offers automatic authentication for your DNS provider you can follow that wizard; otherwise, select manual authentication to see the records requested.
2. Create each TXT or CNAME record with the exact name and value. If Brevo shows @ or leaves the name empty, it refers to the root domain; cPanel may show it as the full name. If the panel fills in the domain automatically, do not type it twice.
3. Keep the MX and other records for your existing email: authenticating Brevo does not mean you have to move your mailboxes.
4. Only if Brevo explicitly shows an SPF record, merge it into the existing TXT record that starts with v=spf1. Do not publish two SPF records.
5. If DMARC already exists, edit it to the policy you need instead of creating a second _dmarc.

Brevo's official documentation describes the current records in Authenticate your domain with Brevo.

Verify the authentication

Wait for propagation and go back to Brevo to request validation. If it fails:

• Confirm that you edited the authoritative zone.
• Check that the name does not contain the domain twice.
• Check for quotation marks, spaces and trailing dots added by the editor.
• Look for duplicate SPF or DMARC records.
• Check publicly that each record returns the value shown by Brevo.

Correct authentication does not on its own guarantee that every message will reach the inbox. Content, recipient lists, complaints and sending reputation also play a part.

If the domain already has DKIM or DMARC

Several platforms can use different DKIM selectors on the same domain. Do not delete the key for your usual email to publish Brevo's. If the exact name already exists, confirm with the provider whether it is a rotation or a conflict before replacing it.

If you already have DMARC with a stricter policy, do not automatically replace it with p=none. Check how Brevo authenticates and aligns its messages and keep any report destinations that are still needed.

You can prepare the changes with the DNS assistant. Finish with a test send from Brevo and check its headers: a screen saying "domain authenticated" does not prove that every message will be delivered.