Three deliverability fixes for transactional email, headlined by a new Email Authentication panel on the Brevo Senders page that lets admins fix SPF and DMARC with one click.
The new panel sits above the existing MX records panel and shows colour-coded badges for SPF and DMARC, the current record contents, and a Fix Auth Records button that merges missing includes or creates the records. Existing policies are never widened; multi-record SPF states disable the button with a tooltip pointing at manual consolidation.
ashfordramblers.org.uk — SPF exists for the Cloudflare mail path but misses spf.brevo.com. DMARC is already in place and is left untouched.
canterburyramblers.org.uk — same SPF gap, but this domain runs p=reject. The fix will merge in the Brevo include while preserving the stricter policy exactly.
canterburyramblers.org.uk after Fix Auth Records — SPF now contains both _spf.mx.cloudflare.net and spf.brevo.com; p=reject is retained.
berkshire-weekend-walkers.ngx-ramblers.org.uk — nothing at all. The panel shows exactly what will be created before the button is pressed.
Fresh v=spf1 include:_spf.mx.cloudflare.net include:spf.brevo.com ~all created, plus a monitor-only v=DMARC1; p=none so the admin can raise enforcement later without surprise.
textContent derived from HTML when the caller supplied none. HTML-only mail is a documented spam-filter penalty signal.<mailto:replyTo?subject=unsubscribe> is added to transactional sends unless the caller sets its own. Campaigns are unchanged; Brevo manages their unsubscribe headers natively.baseDomain. Per-domain failures are logged and skipped — one bad zone can't block the rest.apexHost() helper strips www. on both sides of the site/Brevo-domain comparison.errorResponse(error) returns {code, message} so clients see the real cause instead of a serialised empty Error.