Brevo SMTP: Setup, Settings, and Troubleshooting Guide

Brevo SMTP moves an application’s outgoing mail off a web host’s local mail agent and onto infrastructure that authenticates, logs, and reports on every message. The setup is small: one hostname, one port, two credentials. Getting it wrong is also small, and the failure modes are quiet. This guide covers the settings, the credential model, the DNS work that makes delivery happen, and the errors you will hit if any piece is misconfigured. If you are still choosing a provider, the broader SMTP email service guide compares the market first.

What Brevo SMTP Is

Brevo describes Brevo SMTP as its SMTP relay service. Your application, website, or mail server hands a message to the relay over an authenticated connection, and Brevo takes responsibility for routing, retries, reputation, and reporting. Statistics for relayed mail appear alongside campaign statistics, and a hard bounce automatically blocklists that contact.

The relay is built for transactional messages: password resets, receipts, order confirmations, account notifications. If the line between those and marketing mail is not sharp yet, what transactional email is covers it.

SMTP or the REST API

Both paths reach the same platform. The practical split:

One hard limit: Brevo’s developer documentation states the SMTP relay does not support batch sending, and directs batch operations to the API endpoints.

Creating Your SMTP Credentials

Brevo’s SMTP authentication uses two values that are easy to confuse with credentials you already have.

Find your SMTP login

Your SMTP login is not your Brevo account email address. It is a separate identifier shown in the Login field on the Settings, SMTP and API page, in the format [email protected].

Two rules follow, both from Brevo’s troubleshooting documentation. Do not put smtp-relay.brevo.com in the username field: that is the relay host, not your login. And do not put your SMTP login in the From header, because it authenticates you rather than identifying a sender.

Generate an SMTP key

The password is an SMTP key, not your account password and not an API key.

1. Open the account dropdown and select Settings, then SMTP and API.
2. Under the SMTP tab, click Generate a new SMTP key.
3. Name the key after the integration that will use it.
4. Choose the variant. Standard is the recommended 64 character key; Short is a 15 character key, for clients that cannot handle long passwords.
5. Set an expiry between 7 days and 1 year, or choose no expiration.
6. Click Generate, then copy the full key immediately.

The full key is displayed once, after which the page shows only its last few digits. If you lose it, generate a replacement and update your configuration.

Connection Settings

The values to enter in any client or library:

Choosing a port

Brevo recommends 587 as the default. Port 465 was designated for SMTP over SSL and later deprecated, but remains widely supported and is right when you need the connection encrypted before the first command. Port 2525 is not an IETF or IANA registered port, but most ISPs and cloud providers allow it, which makes it the escape hatch when 587 is blocked.

The encryption field trips people up. Brevo tells you to leave it empty unless you are on 465. That does not mean the connection is unencrypted: on 587 and 2525 the server advertises STARTTLS and any competent client upgrades before authenticating. It means you should not select “SSL” while connecting to 587, because a port and encryption mismatch fails authentication even with correct credentials.

Test the connection before writing any code

Confirm the relay answers and that TLS negotiates before debugging application code.

openssl s_client -starttls smtp -crlf -connect smtp-relay.brevo.com:587

A successful handshake ends with the server’s 250 capability list, which should include STARTTLS and an AUTH line listing PLAIN and LOGIN. No banner at all is a network problem, not a credential problem.

Authenticating Your Sending Domain

This is the step people skip, and it decides whether anything arrives. Since 1 February 2024 domain authentication has been mandatory under Gmail and Yahoo’s sender requirements, and Brevo notes Microsoft announced similar standards on 5 May 2025. Unauthenticated mail is filtered or rejected regardless of which relay sent it.

The records Brevo asks for

Brevo can add these automatically if you log in to your domain provider from inside Brevo, or you can copy the values into your DNS zone by hand. Which DKIM form you get depends on the account: two CNAME records use a 2048 bit key by default, the single TXT form a 1024 bit key.

Why there is no SPF record

Brevo’s FAQ is explicit: SPF and MX records are not required to authenticate a domain, and are only provided when setting up a dedicated IP. On shared infrastructure Brevo controls the return path, so DKIM plus the ownership check carries the authentication. If you are migrating from a provider that demanded an SPF include, do not invent one; an unnecessary include only risks a lookup limit problem.

DMARC still matters, and Brevo publishes a working starting record:

v=DMARC1; p=none; rua=mailto:[email protected]

Start on p=none for aggregate reports without risking delivery, then tighten to quarantine and reject once every legitimate source is aligned. Our email deliverability guide covers that progression.

Verify the sender

Every From address must be a verified sender or sit on an authenticated domain. A new sender is verified with a 6 digit code sent to that address, but senders on an authenticated domain skip that step, which is why you authenticate first. Free mail domains cannot be authenticated, so a From address at gmail.com or outlook.com will be rejected or filtered.

Integration Walkthroughs

WordPress

WordPress hands outgoing mail to wp_mail, which calls whatever the host provides. Routing it through Brevo takes a plugin.

1. In the admin sidebar go to Plugins, then Add New Plugin.
2. Search for Brevo, install “Newsletter, SMTP, Email marketing and Subscribe forms by Brevo”, then activate it.
3. Go to Brevo, then Home, and enter your Brevo API key v3 in the activation field. This step uses an API key because the plugin also syncs contacts. Click Login.
4. Under Transactional emails, select Yes.
5. Choose an existing sender or create one. Every WordPress email uses that sender name and address.
6. Enter an address and click Send email to fire a test.

Two errors are common. A message that transactional emails are not activated because your Brevo SMTP account has not been activated means Brevo support must switch the platform on. A message that SMTP cannot be used because wp_mail has been declared by another process means a competing SMTP plugin; deactivate the others one at a time.

A server-side application

Brevo’s own Node.js example uses nodemailer and the settings above:

const nodemailer = require("nodemailer");

const transporter = nodemailer.createTransport({
  host: "smtp-relay.brevo.com",
  port: 587,
  secure: false, // true for 465, false for other ports
  auth: {
    user: process.env.BREVO_SMTP_LOGIN, // [email protected]
    pass: process.env.BREVO_SMTP_KEY,
  },
});

async function sendOrderConfirmation() {
  const info = await transporter.sendMail({
    from: '"Acme Support" <[email protected]>',
    to: "[email protected]",
    subject: "Your order is confirmed",
    text: "Order 10482 is confirmed and ships within two business days.",
  });
  console.log("Message sent:", info.messageId);
}

sendOrderConfirmation().catch(console.error);

Note secure: false on port 587. That flag controls implicit TLS, not whether the connection is encrypted; nodemailer still issues STARTTLS. Set true only for 465.

The Python equivalent with the standard library:

import smtplib, ssl
from email.message import EmailMessage

msg = EmailMessage()
msg["From"] = "Acme Support <[email protected]>"
msg["To"] = "[email protected]"
msg["Subject"] = "Your order is confirmed"
msg.set_content("Order 10482 is confirmed and ships within two business days.")

with smtplib.SMTP("smtp-relay.brevo.com", 587, timeout=20) as server:
    server.starttls(context=ssl.create_default_context())
    server.login(BREVO_SMTP_LOGIN, BREVO_SMTP_KEY)
    server.send_message(msg)

Both read credentials from the environment, which is the next section.

Key Security and Rotation

Brevo treats SMTP keys as passwords. The operational rules are worth following literally.

• One key per integration. Name each key after the system that uses it, so a leak or a decommission revokes exactly one thing.
• Never commit a key. Environment variables, a secrets manager, or your platform’s config store. Not source control, not a tracked .env file, not a screenshot.
• Rotate without downtime. Generate the replacement, deploy, confirm sending, then delete the old key. Deletion is irreversible, and deleting a key still in use stops transactional sending immediately.
• Deactivate rather than delete to pause an integration. Keys can be reactivated later.
• Expect expiry. Keys can carry an expiry from 7 days to 1 year, and Brevo expires inactive keys after 90 days.

For a harder boundary, Brevo can block requests from unknown IP addresses. The authorized list is shared between API and SMTP keys, so anything you allow applies to both. Be careful on containerized or cloud workloads: the outbound address may be a NAT gateway rather than the instance IP you expect, and getting it wrong produces a 525 5.7.1 Unauthorized IP address rejection.

Teams running Brevo alongside a storefront, a CRM, and a support desk end up managing several keys, senders, and domains at once. Tajo holds that configuration in one place rather than four dashboards.

Sending Limits and Throttling

SMTP sending draws on your plan’s email credits. On the Free plan that means 300 email sends per day; the limit resets daily and unused sends do not roll over. Once you hit it, Brevo holds up to 1,000 further emails in a retry queue and delivers nothing beyond that queue. Paid plans remove the daily cap, and the Brevo pricing guide breaks down the tiers.

When credits run out entirely, messages submitted over SMTP are paused and queued rather than dropped. The backlog sits under Transactional, then Real time, then Usage and plan, in the Email queue section.

Brevo publishes hard rate limits for the REST API rather than the relay. On the general tier POST /v3/smtp/email allows 1,000 requests per second, and exceeding a limit returns 429 Too Many Requests. The API path also returns rate limit headers to pace against, which the relay does not.

Monitoring Bounces and Complaints

Relayed mail is visible under Transactional, in the Statistics and Logs pages. The events that need a response:

• Hard bounce. The address is invalid, and Brevo blocklists the contact automatically.
• Blocked. The recipient previously complained, unsubscribed, hard bounced, or was blocked manually.
• Deferred and soft bounce. The provider accepted the connection but delayed or refused the message. Recurring deferrals against one provider signal a reputation problem, not a code problem.

Polling logs does not scale. Brevo supports transactional webhooks that push delivery, bounce, open, and complaint events to your endpoint in real time, which is how you keep your own suppression data current.

The number to watch is the spam complaint rate. Gmail, Yahoo, and Microsoft require senders to stay under 0.3%, and Brevo recommends monitoring it with Gmail Postmaster Tools. Recovering from a breach takes far longer than avoiding one.

Troubleshooting

535 5.7.8 Authentication failed

The username or password could not be verified. By likelihood:

• The account email address was used instead of the SMTP login in the [email protected] format.
• smtp-relay.brevo.com was pasted into the username field. Brevo names this as one of the most common causes.
• An API key was used instead of an SMTP key.
• The key carries a trailing space or line break from copy and paste.
• The encryption setting does not match the port.
• The key was invalidated after a security alert, in which case generate a new one.

525 5.7.1 Unauthorized IP address

IP blocking is active and the connecting address is not authorized. Add it, and check your real egress address first if the application runs behind NAT or in a container platform.

No response and no banner

If the TCP connection opens but the server never sends its 220 greeting, authentication cannot begin and the fault is on your side of the network. Corporate firewalls sometimes allow the connection and then silently drop SMTP traffic. AWS, Azure, and Google Cloud restrict outbound SMTP by default on new accounts. Request that the restriction is lifted, or switch to port 2525.

450, platform not activated

The error says your SMTP account is not yet activated or that your sending platform is currently disabled. On a new account, transactional sending requires a separate activation step from Brevo support. On an established account it usually means suspension, either because an unprotected form was hit by bot signups or because the account showed signs of compromise.

Sender rejected

Check three things: the domain is authenticated, the sender is verified, and the From header is not your SMTP login.

Mail is accepted but lands in spam

Work in this order. Confirm the sending domain is authenticated and DKIM is signing. Confirm the From domain is your own and not a free mail provider. Check your complaint rate in Postmaster Tools against the 0.3% threshold. Look at content only after those checks are clean, because it is almost never the first cause.

Dedicated IPs

A dedicated IP only helps at high, consistent volume. It must be warmed up before you send meaningfully through it, and it needs a sending subdomain that appears as the mailed by and return path domain in your headers. This is the one configuration where Brevo provides SPF and MX records, alongside A, CNAME, DKIM, and DMARC records for that subdomain.

Two details catch people out. A dedicated IP configured for marketing email only queues your transactional messages instead of sending them, so switch it or buy a second IP. And separating transactional from marketing routing requires a pool of at least two IPs with distinct senders, so weak engagement on marketing mail cannot drag down receipts and password resets.

Getting It Right the First Time

Authenticate the domain, create a named SMTP key, connect to smtp-relay.brevo.com on 587, and send a test through the real code path rather than a dashboard button. Almost every later problem traces back to one of three things.

• The wrong credential in the username or password field.
• A port and encryption setting that disagree with each other.
• A sending domain that was never authenticated.

Get those right and the relay disappears into the background, which is what transactional infrastructure should do.