# 26-Feb-2026 — add Brevo domain authentication UI and stale DNS cleanup [ref: #167](https://github.com/nbarrett/ngx-ramblers/issues/167)

## [build 500](https://github.com/nbarrett/ngx-ramblers/actions/runs/22424029078) — [commit ca57a0d](https://github.com/nbarrett/ngx-ramblers/commit/ca57a0d25f9dbf723dd3d5906b24dfd1df6530aa)

_____
# Brevo Domain Authentication Guide
- Add domain authentication status badge and authenticate button to mail senders list. 
- Clean up stale TXT records in Cloudflare before creating new ones and skip DNS propagation delay when records are already verified.
- Show actionable fallback message with Brevo Domains link when DKIM is unavailable for subdomains. Add authenticate-brevo-domain environment
setup route and option.
- Use this when setting up sender domain authentication from **Admin > Mail Settings > Senders**.

![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/95e92063-e80c-4bd8-a1ec-c6f4384f631c.jpeg)


## What this feature now does
- Shows current domain authentication status on the Senders tab
- Adds an Authenticate Domain action for the selected sender domain
- Creates or reuses the required brevo-code TXT record in Cloudflare
- Cleans up previously registered parent-domain records when authenticating a configured subdomain
- Detects when Brevo already reports DNS verification and skips unnecessary wait time
- Gives a clear next-step message with a direct Brevo Domains link when API authentication cannot complete
## Expected flow for a normal domain
1. Open Admin > Mail Settings > Senders
2. Click Authenticate Domain
3. Wait for status refresh
4. If Brevo returns all required DNS records, the status changes to authenticated
## Expected flow for subdomains
For subdomains e.g. `xxxx.ngx-ramblers.org.uk`, Brevo may not return DKIM via API.
### In this case:
1. Click Authenticate Domain in NGX-Ramblers
2. Use the warning link to open Brevo Domains
3. In Brevo, run Authenticate the domain yourself
4. Return to NGX-Ramblers and refresh or retry authentication
When Brevo completes domain-side authentication, the badge updates to authenticated.
## Troubleshooting
- If authentication targets the wrong parent domain, rerun authentication from the Senders tab. Legacy parent-domain registrations are now removed automatically for configured subdomain flows.
- If Brevo returns HTTP 400 mentioning missing DKIM/DMARC, complete the manual Brevo step and retry.
- If sender deletion appears successful but the sender still exists remotely, the API now surfaces this as a failure instead of reporting success.
### Technical details:
- Sender domain status and Authenticate Domain action were added to the Senders tab.
- Legacy parent-domain registrations are automatically removed for configured subdomain authentication flows.
- Existing verified DNS records are reused to avoid unnecessary propagation waits.
- Sender deletion now returns failure when Brevo still reports the sender after delete.