Brevo

Brevo (formerly Sendinblue) is a French all-in-one marketing platform – newsletters, SMS, CRM – with a transactional email API included. Data is hosted in the EU and the free plan allows a few hundred emails a day.

Choose Brevo when you already use it for newsletters or CRM and want everything in one place, or you want an EU-hosted provider with a generous free daily allowance. If you need only transactional email and top deliverability, compare with Postmark or Mailgun in the services overview.

Prerequisites

A Brevo account with transactional email activated. New accounts are sometimes held for validation before they can send transactional email.
A verified sender: add and authenticate your domain in Senders, Domains & Dedicated IPs → Domains, and add the From address under Senders.
A v3 API key from SMTP & API → API keys → Generate a new API key (starts with xkeysib-). Brevo API keys are not scoped – create a dedicated key named e.g. “Frontmail” so you can revoke it independently. Do not use the SMTP key (xsmtpsib-…); Frontmail uses the HTTP API.
If Authorised IPs (Security settings) is enabled for your account, either disable it or add Frontmail’s outbound IPs – otherwise every call is rejected with 403 unrecognised IP address.

Connect in Frontmail

Open Email services → Add service → Brevo.
Fill in the fields:

Field	Where to find it	Example
API key (v3)	SMTP & API → API keys (shown only once)	`xkeysib-1a2b3c…-XyZ`
Webhook token	Optional – the token you choose for the Brevo webhook (see below)	`9f8e7d6c5b4a…`
Max emails per second	Optional; default 10/s	`10`

Click Verify & save – Frontmail reads your Brevo account details with the key.
The service is saved once the check passes. Credentials are encrypted with AWS KMS envelope encryption.

DNS: SPF, DKIM and DMARC

Brevo lists the records under Senders, Domains & Dedicated IPs → Domains → Authenticate. Typical values:

; Domain ownership code
example.com.                   TXT    "brevo-code:1a2b3c4d5e6f7a8b9c0d"

; DKIM – newer domains get two CNAMEs, older ones a single TXT at mail._domainkey
brevo1._domainkey.example.com. CNAME  b1.example-com.dkim.brevo.com.
brevo2._domainkey.example.com. CNAME  b2.example-com.dkim.brevo.com.

; SPF – merge into your existing record
example.com.                   TXT    "v=spf1 include:spf.brevo.com ~all"

; DMARC
_dmarc.example.com.            TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Copy the exact record names and values from Brevo – the DKIM format has changed over time (mail._domainkey TXT vs brevo1/brevo2 CNAMEs) and older accounts may still show include:spf.sendinblue.com.
Brevo treats a DMARC record as required for domain authentication; p=none is enough to start. Tighten to p=quarantine / p=reject after reviewing reports.

Regions

Brevo has a single API endpoint (api.brevo.com/v3) and hosts data in the EU. There is nothing to select in Frontmail.

Sandbox & limits

Free plan: 300 emails per day (transactional and marketing combined).
Paid plans are based on a monthly email volume; when the credits run out Brevo answers 402 not_enough_credits, which Frontmail treats as an auth error (the service is unusable until you top up).
Account validation: until Brevo validates your account, the API may reject sends with account_under_validation.
Brevo supports a X-Sib-Sandbox: drop header for dry runs; Frontmail doesn’t use it.

Webhooks (delivery tracking)

Copy the webhook URL from the service page in Frontmail (copy button):
```
https://api.frontmail.dev/webhooks/providers/brevo/<token>
```
In Brevo open Transactional → Settings → Webhook → Add a new webhook (newer UI: Settings → Webhooks → Transactional).
Paste the URL and, under authentication, choose Token. Generate a long random token, paste it in Brevo and into the Frontmail field Webhook token. Brevo then sends Authorization: Bearer <token> with every call. (Basic auth also works – use the token as the password.)
Select the events:

Brevo event	Frontmail event
Delivered	`delivered`
Hard bounce, Invalid email	`bounced` (hard) – added to the suppression list
Soft bounce, Blocked	recorded as a soft bounce
Deferred	recorded on the message
Complaint (spam)	`complained` – added to the suppression list
Opened	`opened`
Clicked	`clicked`

Signature verification: Brevo does not sign payloads. The secret token in the URL identifies the service and, when you set a Webhook token, Frontmail rejects calls whose bearer token (or Basic auth password) does not match.

Frontmail tags each message with fm:<message id> so events can be matched.

Common errors

auth – the service is broken (invalid key, IP not authorised, no credits left, account under validation). The service is marked unhealthy; the owner gets an email and a dashboard banner. A fallback service on the template takes over; otherwise the credit is refunded and the message waits in the hold queue as held_service_error, sent automatically after you fix the service (re-checked on save and by the daily health check).
permanent – this message can’t be sent (invalid recipient, invalid or unverified sender, 400 validation). Fallback service if configured, otherwise failed and refunded.
transient – 5xx, 429, timeouts. Retried with exponential backoff; after the last attempt failed and refunded.

Brevo response	Class	What to do
`401 unauthorized` – Key not found	auth	Generate a new v3 API key (not the SMTP key) and update the service.
`403 permission_denied` – unrecognised IP address	auth	Disable Authorised IPs or add Frontmail’s IPs.
`402 not_enough_credits`	auth	Upgrade the plan or wait for the daily/monthly allowance to reset.
`400 account_under_validation`	auth	Finish Brevo’s account validation (check your Brevo inbox).
`400 invalid_parameter` – sender is invalid / not verified	permanent	Add and verify the From address under Senders.
`400 invalid_parameter` – email is not valid	permanent	See invalid recipient.
`429 Too Many Requests`	transient	Rate limited; retried with backoff.
`500` / `502` / `503`, timeout	transient	Brevo outage – Frontmail retries.

Checklist

Transactional email activated, account validated
Domain authenticated: brevo-code, DKIM, SPF, DMARC
From address added under Senders
Dedicated v3 API key (xkeysib-…), Authorised IPs off or Frontmail allowed
Test connection passes
Transactional webhook with Token auth, same token in Frontmail
Events: delivered, hard/soft bounce, invalid, blocked, complaint (+ opened/clicked)