Brevo Setup: The Complete Onboarding Checklist

Most Brevo accounts we take over at the agency were set up in the wrong order: list imported first, domain authenticated two weeks later, attribute structure improvised as needs came up. The result: a half-usable list, fields that were never created on the account side, and a first send that goes out with incomplete DNS alignment.

This checklist follows the order that avoids those repairs. It's built for an ecommerce brand or a CRM manager starting a Brevo account who wants to go from zero to a clean first send without having to go back and fix things.

Phase 1: sender foundations, before any data

Brevo explicitly separates two operations that many people conflate: validating the sender address and authenticating the domain. The developer documentation puts it without ambiguity: verify the sender's email to confirm its authenticity, and authenticate the domain so the sender appears as verified (Brevo, senders and domains). Both, not one or the other.

1. Create and validate your senders

A Brevo sender is an authorized address. It's created in the interface or via API, with a POST to https://api.brevo.com/v3/senders, which triggers a verification email to that address (Brevo, sender creation and management).

Method points at this stage:

• Choose an address that's actually monitored. A ghost inbox breaks the reply loop and deprives you of a useful engagement signal.
• Avoid building your entire strategy around a no-reply address. We cover why in no-reply email addresses: risks and alternatives.
• Separate the marketing sender from the transactional sender from the start, even if both go out from the same domain. That gives you room later to segment your flows.

2. Authenticate the sending domain

This is the step most often rushed. Brevo publishes the DNS records to create in its interface when you add the domain: pull them directly from your account rather than copying values found elsewhere, they're specific to your setup.

What is universal, on the other hand, is what inbox providers require. Gmail requires SPF or DKIM from every sender, and adds DMARC once you go past 5,000 messages a day to Gmail addresses (Google, sender requirements). A detail that trips up multi-tool brands: that 5,000 threshold is calculated at the primary domain level, messages sent from the same primary domain count together (Google, 5,000+ senders). If you send your campaigns from Brevo and your service emails from another tool on the same domain, the volumes add up.

Yahoo, for its part, requires SPF and DKIM, plus a valid DMARC policy at minimum p=none, with a DMARC that must pass (Yahoo, best practices).

3. Check alignment, not just that the records exist

An SPF record that exists isn't enough. Google requires the organizational domain of the From: header to align with either the SPF organizational domain or the DKIM organizational domain (Google). That's exactly what breaks when you send from a poorly declared subdomain.

On the DMARC side, the sequence recommended by dmarc.org is to start at p=none, then harden toward quarantine and reject as you gain experience and alignment is verified (dmarc.org). Jumping straight to reject on a domain whose sending flows you don't fully know yet is a guaranteed incident.

The detail of the syntax and DNS edge cases is covered in SPF, DKIM, DMARC: DNS setup.

Phase 2: data structure, before the import

This is the step nobody wants to do, and it's the most expensive one to skip.

4. Map your attributes before creating anything

A standard Brevo account is capped at 200 contact attributes, 300 lists and 300 folders (Brevo, platform quotas). Those ceilings are generous for a brand starting out, but they fill up fast when every campaign creates its own ad hoc attribute and every operation its own list.

Lay out on a sheet, before touching the account:

• the attributes coming from the source of truth (Shopify, ERP, back office);
• the attributes computed on the CRM side (RFM segment, VIP status, acquisition channel);
• the structural lists you actually need, as opposed to dynamic segments, which don't consume a list slot.

The sorting rule is simple: if the information is used for targeting, it's an attribute or a segment. If it's used to tell a story in a report, it has no business being in the email account. Our structuring method is detailed in ecommerce CRM strategy: data, segments and journeys.

5. Prepare the import file to match the real constraints

Two documented constraints to know before launching an API import:

• The maximum file body size is 10 MB, and Brevo recommends staying around a safe limit of 8 MB (Brevo, import contacts).
• Any attribute that doesn't already exist in your account is ignored at the end of the import (same source). That's the classic trap: the import comes back as a success, the contact count is right, and three columns out of twelve have vanished into thin air.

Hence the order: create the attributes, then import. Never the reverse. And check on a test batch of a few hundred contacts that every field actually landed before pushing the full list.

6. Clean before loading, not after

Importing a historical list without sorting it is buying a reputation problem with money you haven't spent yet. Addresses never engaged in 18 months, duplicates, role-based addresses, typos: all of that gets handled in the source file. The sorting principles carry over from list hygiene: cleaning your list, and the bounce logic is detailed in soft bounce vs hard bounce.

Phase 3: consent and compliance

7. Settle the consent question before the first send

For companies operating in France, the CNIL is clear on electronic prospecting toward individuals: it's allowed provided people gave their consent before being solicited (CNIL). The exception concerns a person already a customer of the company, when the prospecting covers similar products or services supplied by the same company (same source).

In B2B, the CNIL accepts a legitimate-interest basis for the organization when the subject of the solicitation relates to the professional role of the person being contacted (same source). It's not a blank check: it stays conditional on the message's subject.

Two obligations apply to every send: the person must be able to identify the organization sending the message, and express by a simple means their refusal to receive further solicitations (same source). In practice, in the footer: the company's identity and an unsubscribe link that actually works.

For the full framework, see GDPR email marketing: compliance checklist.

8. Turn on double opt-in correctly

Brevo's double opt-in isn't a checkbox on a standard API form. It runs through a dedicated endpoint, POST https://api.brevo.com/v3/contacts/doubleOptinConfirmation, which requires two parameters: a templateId matching the double opt-in template, and a redirectionUrl, the page the user is redirected to after clicking the confirmation link (Brevo, DOI contact).

In other words: if you want DOI, you need to create the template and the confirmation page before wiring up your forms. Many integrations go through the standard contact-creation endpoint thinking they're doing DOI, and end up with single opt-in instead.

9. Wire unsubscribes within the expected timeframes

Yahoo requires unsubscribes to be processed within 2 days (Yahoo). Google recommends processing requests within 48 hours, and specifies that one-click unsubscribe is only required for marketing and promotional messages (Google).

The practical thing to watch: if your unsubscribes flow through a third-party system (your back office, a homemade form), check the sync delay with Brevo. A daily batch is fine. A weekly one isn't.

Phase 4: automations and technical integration

10. Count your workflows before you build them

A standard Brevo account allows 50 automation workflows active at once, versus 500 on Enterprise (Brevo, platform quotas). Fifty is comfortable for a brand starting out, as long as you don't split every variant into a separate workflow. A cart-abandonment scenario broken into six workflows per segment uses up six slots where conditional logic would use just one.

Prioritize the core before the refinements: welcome, cart abandonment, post-purchase, reactivation. The detailed setup is in Brevo Automation: the new editor step by step and, for the store integration, in Brevo Shopify: setup and essential flows.

11. Tell the API key and SMTP credentials apart

Two sets of credentials, two uses, and a frequent point of confusion during integration.

If your developer tries to authenticate to the SMTP relay with the API key, it won't work: these are genuinely two separate credentials.

12. Instrument the rate limits from the start of the integration

Two very different orders of magnitude to know before wiring up transactional email:

• sending via POST /v3/smtp/email accepts up to 1,000 requests per second under the general limits;
• retrieving logs via GET /v3/smtp/emails is capped at 2 requests per second (Brevo, API limits).

Monitoring that naively polls the logs in a loop will therefore hit a 429 well before the sending itself does. To plan ahead, Brevo returns three quota headers on every response: x-sib-ratelimit-limit, x-sib-ratelimit-remaining and x-sib-ratelimit-reset (Brevo, limit headers). Log them from day one; they'll save you a blind diagnosis on an evening with an order spike.

Phase 5: monitoring before the first mass send

13. Open Google Postmaster Tools and accept the initial silence

Create the Postmaster Tools account and verify the domain before ramping up volume. Important point so you don't panic: data can be missing if the total number of messages for a given day is too low, to protect user privacy (Google Postmaster Tools). An empty dashboard on a brand-new account doesn't signal a configuration error.

14. Set your complaint thresholds as a steering target

Google requires keeping the user-reported spam rate under 0.1% and making sure it never reaches 0.3% or higher (Google). Yahoo sets its threshold at 0.3% (Yahoo).

Treat 0.1% as the steering line, not as a limit to skim. The full context of these rules is developed in Gmail and Yahoo sender requirements.

15. Ramp up volume progressively

A new domain or a new account has no history. Start with your most engaged segments (recent buyers, subscribers from the last few weeks), then widen in stages while watching complaints, bounces, and unsubscribes. The Brevo-specific settings are detailed in Brevo deliverability: 7 essential settings, and the diagnosis for when something goes wrong in why my Brevo emails go to spam.

The one thing not to settle at launch: the plan

One question comes up systematically during scoping: which plan to pick, and at what volume it's worth switching. Brevo's pricing grids evolve and the public pages aren't always readable by an extraction tool: go and pull the prices and what's included directly from Brevo's pricing page at the moment you decide, rather than trusting a figure copied from an article.

Also worth not confusing: the quotas on the platform quotas page (attributes, lists, workflows) are technical platform ceilings, not a plan's commercial inclusions. These are two distinct logics.

If the trade-off is more about the tool than the plan, Brevo vs Klaviyo: which one to choose lays out the decision criteria.

The checklist at a glance

This order isn't cosmetic. Every skipped step gets paid back in repairs: a forgotten attribute gets fixed with a full re-import, a botched DNS alignment gets paid for in spam placement during the very weeks your reputation is being built.

If you want an existing setup audited or a clean launch scoped out, that's the work we do through our Brevo agency. And to go further into the platform's step-by-step configuration, the Brevo tutorial: full setup in 11 steps picks up on the interface side.

FAQ

Should I authenticate the domain before importing contacts?

Yes. Authentication doesn't depend on the list, it depends on DNS, and its propagation takes time. Starting with this step gives you room to check alignment while you prepare the import file.

Why do some columns from my file not show up after a Brevo import?

Because any contact attribute that doesn't already exist in your account is ignored at the end of the import, as Brevo documents on its import endpoint. Create the attributes in the account, then rerun the import on a test batch before the full list.

Does the Brevo API key also work for the SMTP relay?

No. The API key is used in the api-key header on https://api.brevo.com/v3/, while the SMTP relay goes through smtp-relay.brevo.com with separate credentials, on port 587 or 465 depending on encryption.

At what volume do I need to publish a DMARC record?

Gmail requires SPF or DKIM for all senders, and adds DMARC past 5,000 messages a day to Gmail addresses. Yahoo, for its part, requires a valid DMARC policy at minimum p=none from bulk senders. In practice, publish a p=none from day one: it's free and it gives you the reports you need before hardening it.

How many workflows can I activate on a standard Brevo account?

Fifty workflows active at once on a standard account, 500 on Enterprise, per the platform quotas page. Group your variants by conditions rather than creating one workflow per segment.

Setting up Brevo for the first time, or auditing an account someone else configured? Talk to the Deliver team.