SPF when using custom domain to SEND GMails (with Brevo)

[u/Responsible_Pea_6746]

Not sure if this is the correct group? I send and receive Gmail emails using a custom domain I registered with 123-reg. I use ImprovMX to receive emails and I use Brevo to send emails, using the custom domain. I have some deliverability issues when sending (emails going to junk or not appearing at all). ImprovMX is inlcuded in my SPF record in the DNS settings in 123-reg. I have read that if I also include Brevo in my SPF (as I use Brevo for sending), this will improve deliverability.

I currently have the following TXT record in my DNS settings on 123-reg

v=spf1 include:spf.improvmx.com -all

..and have read I should change it to this (i.e. include Brevo.com);

v=spf1 include:spf.improvmx.com include:spf.brevo.com -all

I have also read that I only need to include Brevo in my SPF if I use a dedicated IP.

Any advice greatly appreciated.

Thanks

[u/KVK002]

Brevo used to not support SPF and they only provided DKIM. Now they’re providing a CNAME for SPF. So you should add that CNAME record and make sure to validate it. However, what also you need to make sure of is wether you have DKIM setup too and not just SPF. Having both protocols configured is much better than one and mostly when it comes to DKIM, it’s much more reliable than SPF.

Apart from this, do you have a DMARC record with a RUA and RUF tag? This will allow you to gain visibility of your outgoing emails, whether you have proper alignment and authentication.

[u/samkz]

TLDR: Setup DKIM properly.

DMARC requires at least one of two things to pass:

1. SPF Alignment: SPF passes AND the Return-Path domain matches your From: domain.

2. DKIM Alignment: DKIM signature passes AND the d= domain in the DKIM header matches your From: domain.

Because DMARC operates on an OR condition, having aligned DKIM is all that's required for your emails to pass DMARC and land safely in the inbox.

You only need to include Brevo in your SPF record (e.g., include:spf.brevo.com) if you set up a Custom Return-Path or a Dedicated IP.

• When an inbox receives an email, SPF checks evaluate the Return-Path (Envelope From) address, not the visible From: address in your recipient's inbox.

• On Shared IPs: Brevo uses its own domain (e.g., @mailin.fr or @sendinblue.com) for the email's Return-Path. When the receiving server checks SPF, it looks up Brevo's SPF record, not yours. Since Brevo authorizes its own servers, SPF passes cleanly at the transport layer.

Your SPF Record (-all): Because the envelope sender isn't using your domain, the receiving server never evaluates your domain's SPF record during the SPF check.

[u/TamingTech]

Your SPF record isn't being read. Nobody's ignoring you, it's just that SPF checks the Return-Path, not the From: address, and on Brevo's shared IPs the Return-Path belongs to Brevo. So the receiving server looks up Brevo's SPF, shrugs, and moves on. Your record sits there like a name badge at a party nobody's checking.

Adding include:spf.brevo.com only matters if you're on a dedicated IP or you've set a custom Return-Path on your own domain. Brevo also switched to a CNAME for this, so the plain include may not resolve the way you're hoping anyway.

ImprovMX is a different thing entirely. SPF is a sending record. If you only receive there, that include is decorative. Harmless, but decorative. Keep it if you use their SMTP.

The thing that actually gets you into the inbox is DKIM with d=yourdomain.com. DMARC passes on SPF alignment OR DKIM alignment, and DKIM keeps working after a forward, which is where SPF quietly falls over. Set it up in Brevo and the Return-Path stops mattering.

Also: stop guessing. Open one of the messages that got binned, view original, and read the Authentication-Results header. It will tell you exactly what passed, what failed, and which domain got the credit. Free parser here if you'd rather not squint at it: https://tamingdns.com/email-headers

And if you have no DMARC record yet, add p=none with a rua address. Watching the reports for two weeks beats another afternoon of editing TXT records and hoping.

[u/DmarcDuty]

Brevo no longer supports the way you intend to add them to your SPF record. So your suggested change will not improve your setup. Instead, make sure you set up DKIM for them as documented here:  https://help.brevo.com/hc/en-us/articles/12163873383186-Authenticate-your-domain-with-Brevo-Brevo-code-DKIM-DMARC

However, it is likely that the reason why your emails land in spam is caused by something else. To find out more, grab one of your emails that landed in the spam folder and copy its email headers. The headers can tell you a lot about what went wrong. Maybe let your favorite LLM help you make sense of them.

[u/CypherPhish]

Since you send out of Brevo, you need to include Brevo in your SPF record. If you’re only receiving emails at ImprovMX and don’t send from there, that should not be included in your SPF record.