Brevo SMTP Setup Without Burning Your Domain

Brevo SMTP should be configured as a narrow transactional route, not as a general-purpose pipe for every address your company can collect. Create a separate SMTP credential for the application, authenticate the exact sending domain, start on port 587 with TLS, test one event end to end, and enforce your account's sending ceiling before production traffic reaches the relay. Most domain damage starts outside the SMTP form: an exposed credential, unauthenticated identity, uncontrolled retry loop or traffic that Brevo's policy does not permit.

Decide What the Relay Is Allowed to Carry

Brevo's SMTP integration guide positions the relay for transactional messages such as order confirmations, password resets, account creation notices and other automated messages. Start with an allowlist of approved triggers rather than a vague label such as "system email."

A useful route definition names the event, recipient relationship, sender, reply destination, template, urgency and suppression treatment. For example: "A registered user requests a password reset, so the account service sends one expiring reset link from security@notify.example.com." That is much safer than allowing any internal tool to submit any recipient and From address.

Our view: the best protection for a sending domain is a small blast radius. Give each application its own credential, sender set and approved trigger list. Keep newsletters, product lifecycle campaigns and sales prospecting out of the transactional route unless each stream has passed its own policy and operating review. One relay account should not become a shortcut around those decisions.

1. Create a Dedicated SMTP Credential

In Brevo, open Settings > SMTP & API, select the SMTP tab and generate a new SMTP key. Brevo's SMTP credential guide recommends naming the credential after its integration and using a different credential for each integration. That lets you disable one compromised or retired application without stopping every sender.

Use the standard 64-character key unless the client cannot accept long passwords. Brevo offers a 15-character short credential for clients that truncate them. Choose an expiry your team can manage, copy the credential when displayed and store it in a secrets manager. Brevo only shows a new credential in full once. Never put it in source code, a ticket or a screenshot.

2. Enter the Brevo SMTP Settings

Brevo's transactional SMTP instructions give the following connection values:

The SMTP login may be the Brevo account email or an automatically generated address ending in @smtp-brevo.com, depending on when the account was created. Copy the current value from the SMTP page rather than assuming the account login is correct.

Brevo's port guidance recommends port 587 with TLS. Port 2525 is the fallback when a host blocks 587, while port 465 supports SSL encryption. Do not disable transport security just to make a test pass. Map labels such as STARTTLS or implicit TLS to the client's current documentation and verify the connection.

3. Authenticate the Sending Domain Before Sending

Add the domain or subdomain that appears after the @ in the From address under Settings > Senders, Domains, IPs > Domains. If you send from several domains, authenticate each one. Do not treat verification of one mailbox as authentication of every address the application might generate.

Brevo's current domain authentication guide offers automatic authentication when the DNS provider supports it. For manual setup, the account can show three or four records:

• A Brevo code in a TXT record to verify control of the domain.
• DKIM as either one TXT record or two CNAME records, depending on the account.
• A DMARC TXT record that tells receivers how to handle messages that fail DMARC evaluation.

Copy the hostnames and values from the live account. Do not reuse sample records from an article. If a DMARC record already exists, review and update that record rather than publishing a second one. Brevo says the domain should have only one DMARC record. It also says SPF and MX records are not required for its standard domain-authentication process, so do not replace or merge existing SPF records unless a separate, documented configuration requires it.

DNS changes can take up to 48 hours to appear as authenticated in Brevo. Keep the records in place while Brevo is in use. After the status changes, send to a controlled mailbox and inspect the received headers for the expected From domain and dkim=pass. Authentication is a launch condition, not proof that future content or audiences will be accepted.

A transactional subdomain such as notify.example.com can separate ownership and reporting from employee mail. It does not make poor traffic safe. Authenticate the exact identity and record its owner.

4. Put Quotas and Retries in the Application

Do not discover the sending ceiling when customer messages stop. Brevo's current Free plan limits specify 300 email sends per day, resetting daily with no rollover. After that limit is reached, Brevo says up to 1,000 additional transactional messages are held in a retry queue, while messages beyond the queue are not delivered.

That is a capacity boundary, not a buffering strategy. Read paid allowances and restrictions from the live account and current agreement. Set an internal threshold below the verified allowance and decide which messages can wait. Password resets and security notices should not sit behind a non-urgent batch.

Make retries idempotent. Store the business event ID, recipient, template version, submission time and Brevo message result. A timeout should trigger a status check or controlled retry, not an unlimited loop that submits duplicates and consumes the remaining quota.

5. Enforce Brevo's Traffic Boundary

The current Brevo Acceptable Use Policy says solicitations must be legitimate and expected. It strictly prohibits contact lists scraped from the internet or acquired or purchased from a third party, whether the communication is labeled transactional or marketing.

The policy also requires active, explicit consent, proof of opt-in and an accessible unsubscribe link in marketing or bulk email. It distinguishes those messages from emails sent or triggered directly by a user's action. The SMTP connection method does not make a message transactional. The recipient's action, relationship and expectation do.

Keep these streams out of this relay route:

• Purchased, rented, partner-supplied or scraped prospect lists.
• Cold sequences uploaded by sales simply because SMTP is available.
• Bulk promotions without the required consent and unsubscribe process.
• Messages with a From identity the application is not approved to use.
• Unbounded test jobs, staging traffic to real users and replayed production events.

Vendor policy and applicable law are separate checks. Passing one does not establish the other.

6. Run a Controlled Acceptance Test

Start with one approved trigger and test addresses your team controls. Confirm:

1. The application connects over the intended encrypted port.
2. Authentication uses the integration-specific SMTP login and password.
3. The visible From, envelope path and Reply-To match the approved design.
4. DKIM passes for the authenticated domain and the message appears in Brevo's transactional logs.
5. A reply reaches the monitored mailbox.
6. A hard bounce stops future attempts to that address.
7. A revoked credential fails cleanly and raises an alert.
8. A duplicate event does not create a duplicate message.
9. Quota warnings slow or stop non-urgent submissions before the account ceiling.

Then expand gradually and reconcile application events to Brevo logs. A successful SMTP response means Brevo accepted the submission. It does not prove inbox placement, recipient expectation or business success.

Brevo SMTP is ready when the route is authenticated, encrypted, capacity-aware, observable and limited to traffic the recipient and provider both permit. The form takes minutes. The controls around it protect the domain over time.

If you want to map transactional email, permissioned marketing and outbound prospecting into separate, owned sending systems, book a free ICP and campaign-fit discovery call →.