Provider setup

Mailchimp SPF, DKIM and DMARC: the records domain authentication needs

Which DNS records Mailchimp domain authentication asks for (two DKIM CNAMEs and a DMARC TXT, no SPF record), how to add them, and how Transactional differs.

By Updated Last verified

On this page
  1. Verification is not authentication
  2. The records Mailchimp asks for
  3. What about an SPF record?
  4. The DMARC record
  5. Confirm authentication, then check a real message
  6. Troubleshooting
  7. Mailchimp Transactional is a separate setup
  8. Sources

To authenticate your domain in Mailchimp (opens in a new tab), you first verify your email domain, then add 2 CNAME records (for DKIM) and 1 TXT record (for DMARC) to your domain's DNS. That is the whole list: Mailchimp's instructions include no SPF record. Copy the exact names and values from your Mailchimp account.

Verification is not authentication

Following Mailchimp's domain verification article (opens in a new tab), verification confirms that you are sending from a valid address on a domain you can access:

  1. Click your profile icon and choose Account & billing, then Domains.
  2. In the Email Domains section, click Add & Verify Domain and enter an email address at the domain you want to verify.
  3. Click Send Verification Email, then click Verify Domain Access in the email you receive, or enter its verification code in your account and click Verify.

You only need to verify a domain one time, and the links and codes expire after seven days. If you send from a subdomain, such as you@news.example.com, verify it separately from your root domain.

Verification is required, but on its own it does not impact your email delivery, as Mailchimp's overview of domain authentication (opens in a new tab) puts it. Authentication, adding the DKIM and DMARC records, is the separate process that proves to inbox providers that you are a legitimate sender.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

The records Mailchimp asks for

Mailchimp's setup guide (opens in a new tab) lists the same three records for a manual setup: 2 CNAME records and 1 TXT record.

Record Type What it is for
CNAME 1 CNAME DKIM (DomainKeys Identified Mail)
CNAME 2 CNAME DKIM
_dmarc TXT DMARC (Domain-based Message Authentication, Reporting and Conformance)

Your account shows the Name (Host) and Value for each CNAME. As an illustration, Mailchimp's own domain, checked against live DNS, publishes k2._domainkey.mailchimp.com as a CNAME to dkim2.mcsv.net and k3._domainkey.mailchimp.com as a CNAME to dkim3.mcsv.net, and both targets publish a DKIM key. Copy your own records from your account, not from this page.

To find the instructions:

  1. Click your profile icon and choose Account & billing.
  2. Click the Domains tab.
  3. Click Start authentication next to the verified email domain you want to work with, then select your DNS provider.

From there you have two methods. Mailchimp recommends Entri, which connects directly to your DNS provider to configure the required DNS records automatically: click Continue and log in to your DNS provider. For a manual setup, click Or manually authenticate your domain, then copy the two CNAME records into your DNS provider's settings, followed by the DMARC TXT record with the host _dmarc.

Authentication can only be added to domains that you or your business own and control. Public email services like Gmail and Yahoo can't be authenticated.

What about an SPF record?

Mailchimp's overview (opens in a new tab) lists what proper authentication needs: 2 CNAME records for DKIM and 1 TXT record for DMARC. No SPF record is part of that list.

DMARC does not require SPF to pass. Under RFC 9989 (opens in a new tab), a message passes the DMARC check if one or more of its authenticated identifiers align with the Author Domain (opens in a new tab), the domain in the From header. A DKIM signature (opens in a new tab) produces a DMARC pass if any DKIM-authenticated domain aligns with the Author Domain. For SPF, DMARC relies solely on (opens in a new tab) SPF validation of the MAIL FROM identity.

Alignment (opens in a new tab) means the two domains share an Organizational Domain (relaxed alignment) or are identical (strict alignment).

The DMARC record

DMARC is the TXT record of the three. RFC 9989 (opens in a new tab) publishes it as a TXT record at the name made by putting _dmarc in front of your domain, so _dmarc.example.com for example.com. In Mailchimp's manual instructions (opens in a new tab), that is the Host value _dmarc and the Value (Points To) shown in your account.

Mailchimp notes that Gmail and Yahoo require a published DMARC record for those who send more than 5,000 emails to Gmail or Yahoo addresses in a 24-hour period.

A starting record from the DMARC record generator monitors and sends reports to one address:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The generator's advice is to start at p=none with a reporting address, which does not change delivery, and enforce once your reports show your real senders pass. DMARC policy not enabled covers whether p=none affects delivery and the safe order to move to quarantine or reject.

Confirm authentication, then check a real message

After you publish the records, Mailchimp (opens in a new tab) validates them. Most records update within a few minutes, but this could take up to 48 hours, and you receive an email notification once validation is complete.

  • Authentication in progress: the domain status on the Domains page while authentication is pending.
  • Authenticated: the label next to the domain once authentication succeeds.
  • Resolve or Restart: if authentication fails, a message on the Domains page prompts you to resolve it or restart authentication.

Two further checks once the domain is authenticated:

  • The free SPF, DKIM and DMARC check reads your domain's public DNS records. For DKIM it looks for keys under commonly used selectors, and for DMARC it flags a missing record, a policy of none, no reporting address, a policy that covers only part of your email, and subdomains left at none. A DNS finding shows how your domain is set up; it does not show where a particular message landed.
  • If a message's Authentication-Results header shows dmarc=fail, DMARC fail covers how to read it and how to fix SPF and DKIM alignment for services and forwarded mail.

Troubleshooting

Mailchimp's setup guide (opens in a new tab) covers the common snags.

  • Root domain duplicated in the host name. Depending on your domain provider, you may only need part of the Name field. If you enter k2._domainkey.example.com and k2._domainkey.example.com.example.com is created, update the CNAME record to only k2._domainkey.
  • Records correct, still not authenticated. You may need to wait longer, up to 48 hours, for servers to recognize your changes.
  • CNAME records changed after authenticating. Mailchimp logs and stores your authentication when you set it up, so a later change could interfere with what it has on file. Disable authentication on the Domains page, then re-authenticate after your record changes are complete.

Mailchimp Transactional is a separate setup

Mailchimp Transactional has its own authentication documentation (opens in a new tab). Transactional won't send any email from unverified domains or domains without a valid DMARC policy and DKIM records.

  1. Navigate to Settings and choose Domains, then type your sending domain in the domain input and click Add.
  2. Add two CNAME records for DKIM: mte1._domainkey.example.com with the value dkim1.mandrillapp.com, and mte2._domainkey.example.com with the value dkim2.mandrillapp.com. Checked against live DNS, dkim1.mandrillapp.com and dkim2.mandrillapp.com both publish a DKIM key.
  3. Verify domain ownership: add the unique key shown in your account, which looks like mandrill_verify.Yfe0JuqvZBiYIUXmTwQNiA, to your domain's TXT records, then click Test DNS Settings.
  4. Publish a DMARC policy. Transactional only requires that one exists, and it can be set with p=none.

When you add the _dmarc TXT record, note that some domain hosts automatically add the domain name after _dmarc, so make sure it doesn't appear twice.

Sources

Tools for this

Frequently asked questions

Do I need to add a Mailchimp SPF record?

Mailchimp's current authentication instructions do not list one. They ask for 2 CNAME records for DKIM and 1 TXT record for DMARC, and under DMARC a message passes when any aligned DKIM signature exists.

Is verifying my email domain the same as authenticating it?

No. Verification confirms you have access to the address and is required, but on its own it does not affect delivery. Authentication means adding the DKIM and DMARC records to your DNS.

Do Mailchimp Marketing and Mailchimp Transactional use the same records?

No. Transactional has its own setup: two CNAME records named mte1._domainkey and mte2._domainkey, a mandrill_verify TXT record for domain ownership, and a required DMARC policy.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account