Mailchimp SPF, DKIM and DMARC Setup

Mailchimp authenticates your domain with two DKIM CNAME records and one DMARC TXT record. That is the whole list in its current setup guide. No SPF include is requested. DMARC passes because Mailchimp signs your campaigns with a DKIM key published under your own domain, so the signing domain matches your From address.

The records at a glance

Mailchimp's help pages do not print the CNAME values. They show them inside your account. The values above are what we found on 19 October 2026 at mailchimp.com, intuit.com and canva.com, all three identical. Copy whatever your own account shows. If it differs from this table, your account wins.

Where to find the records in Mailchimp

You have to verify the address before you can authenticate the domain. Verification is a click on an emailed link or a code. It proves you can receive mail there and has no effect on delivery.

Then:

1. Click your profile icon and choose Account & billing (account Managers click Account).
2. Open the Domains tab.
3. Click Start authentication next to the verified domain.
4. Pick your DNS provider from the drop-down and click Next.

Mailchimp now offers two routes. The default uses Entri, which logs in to your DNS host and writes the records for you. The other is Or manually authenticate your domain, which shows Name and Value pairs for CNAME 1, CNAME 2 and the DMARC TXT record, one screen at a time. Shortcuts to the same flow also appear in the Home checklist, in delivery warning banners, and in the From field of the email builder.

DKIM: the part that makes DMARC pass

Each CNAME hands the key lookup to Mailchimp. A receiver that sees s=k2 and d=example.com in the signature asks for k2._domainkey.example.com, follows the alias to dkim2.mcsv.net, and gets Mailchimp's public key. Mailchimp can then change the key on its side without you editing DNS.

Because d= is your domain, the signature aligns with a From address at example.com under DMARC's default relaxed mode (RFC 7489, section 3.1). One aligned pass is enough for DMARC.

A common failure: some DNS hosts add the zone name for you. Type k2._domainkey.example.com into one of those and you get k2._domainkey.example.com.example.com. Mailchimp's troubleshooting note says to enter only k2._domainkey in that case.

What about SPF?

Mailchimp's setup and overview pages list two CNAMEs and one TXT for DMARC. SPF is not on the list. In our scan of the Tranco top 1,000 domains on 19 October 2026, 30 domains still referenced Mailchimp in SPF: 28 with include:servers.mcsv.net and 2 with include:spf1.mcsv.net. Those lines are left over from older instructions. They cost DNS lookups toward the limit of 10 in RFC 7208, and Mailchimp's current guide does not depend on them. Run the SPF checker to see your lookup count before you decide whether to keep one.

DMARC

Mailchimp asks you to publish a TXT record at _dmarc. Its help note ties this to Gmail and Yahoo, which require custom authentication and a published DMARC record from anyone sending more than 5,000 messages a day to their users.

If you already have a DMARC record, keep it. A domain must have only one. Mailchimp's wizard shows a suggested value, but there is no reason to replace a record that already sends reports somewhere useful. If you are starting from nothing, p=none with an rua address is the safe first step. Our generator builds the string, and the record generator guide explains each tag.

Pitfalls specific to Mailchimp

Free mail From addresses. Gmail, Yahoo and similar domains publish strict DMARC policies, and you cannot authenticate them. Mailchimp's answer is to rewrite the From address. thepottedplanter@yahoo.com becomes thepottedplanter.yahoo.com@send.mailchimpapp.com (or the mail.mailchimpapp.com variant). Replies still go to the original address. It works, but recipients see Mailchimp's domain, and you build no reputation for a brand of your own.

Editing CNAMEs after authentication. Mailchimp stores the records it validated. If you change them later, it says to disable authentication on the Domains page first and re-authenticate once DNS is updated.

Waiting. Most records validate within minutes. Mailchimp allows up to 48 hours, emails you when it finishes, and shows Authentication in progress meanwhile.

Mailchimp Transactional is separate. The Mandrill side uses different selectors. Its developer docs ask for mte1._domainkey pointing to dkim1.mandrillapp.com and mte2._domainkey pointing to dkim2.mandrillapp.com, plus a mandrill_verify TXT value. Transactional will not send from a domain without DKIM and a DMARC record, though p=none is accepted.

Check the result

1. DKIM checker: put in your domain with selector k2, then repeat with k3. Both should return a public key through the CNAME.
2. DMARC checker: confirm there is exactly one record at _dmarc.
3. Send a campaign to a Gmail test inbox and open Show original. You want dkim=pass with header.d=example.com and dmarc=pass.

Once reports start arriving, load a few days of them into the aggregate report analyzer. Mailchimp traffic should show DKIM aligned on your domain. If it shows only Mailchimp's own domain, a CNAME is missing or the campaign used an unauthenticated From address.

Frequently asked questions

Sources

• Mailchimp: Set Up Email Domain Authentication
• Mailchimp: About Email Domain Authentication
• Mailchimp: Limitations of Free Email Addresses
• Mailchimp Transactional: Authentication and Delivery
• RFC 7489: DMARC (identifier alignment)