Lookproof Browse tools

DMARC, SPF and DKIM for Mailchimp

Updated 2026-11-06

This guide is for admins who send Mailchimp marketing email from their own domain, here example.com, and want that domain at p=reject. Every Mailchimp value below comes from Mailchimp's help articles on mailchimp.com, read in November 2026. For the background on each protocol, see SPF explained, DKIM explained and DMARC explained.

What Mailchimp sends from

Mailchimp sends your campaigns from its own servers. Three identities matter:

  • From address. The address you choose in the campaign, such as [email protected]. Mailchimp requires you to verify the email domain first. A subdomain you send from, such as [email protected], must be verified separately.
  • Envelope sender (Envelope From, Return-Path). Mailchimp says the sender address "is based on our sending servers, and usually contains" mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net. As of November 2026, the marketing help articles describe no custom Return-Path domain on your own domain.
  • DKIM signing domain. If your domain is not authenticated, Mailchimp says "we'll authenticate it with our domain". That is why some clients show "via mailchimpapp.net" or "on behalf of mcsv.net". After you authenticate your domain, the DKIM key sits under your own domain.

If you use a free address such as Gmail or Yahoo as the From address, Mailchimp may rewrite it to a send.mailchimpapp.com or mail.mailchimpapp.com address. Free domains cannot be verified or authenticated. Use a domain you own.

SPF

As of November 2026, Mailchimp's marketing help articles document no SPF include for example.com. The manual setup asks for exactly "2 CNAME records and 1 TXT record", and the TXT record is for DMARC, not SPF. Mailchimp says the envelope sender usually contains its own domains, such as mcsv.net, and as of November 2026 its marketing help documents no way to use your own domain there. Receivers check SPF against the envelope sender domain, so plan on SPF not aligning for Mailchimp marketing mail and rely on DKIM.

You still need SPF on example.com for your other senders, such as your mailbox provider. Publish one TXT record on example.com. Only one SPF record is allowed per name. If you already have one, edit it instead of adding a second. In this typical setup, include:_spf.example.net is a placeholder for "another service":

example.com TXT "v=spf1 include:_spf.example.net ~all"

We recommend ~all. RFC 9989 warns that some receivers check SPF early in the SMTP transaction, so -all can get mail rejected before DMARC runs, even when aligned DKIM would pass, and that mail never appears in your aggregate reports. This record uses 1 DNS lookup by itself. The limit is 10 (RFC 7208). The included record can add more lookups inside its own tree, so count the whole tree with the SPF lookup counter. See also SPF multiple records.

DKIM

Mailchimp calls this "email domain authentication". It covers DKIM (2 CNAME records) and DMARC (1 TXT record). As of November 2026, these are the documented steps:

  1. Verify the email domain: profile icon, Account & billing, Domains, then Add & Verify Domain. Mailchimp sends a verification email with a link and a code. Links and codes expire after seven days.
  2. Open the setup: profile icon, Account & billing (or Account for a Manager), the Domains tab, then Start authentication next to the verified domain.
  3. In Select your DNS provider, choose your provider and click Next.
  4. Choose automatic setup with Entri, which logs in to your DNS provider and creates the records, or click Or manually authenticate your domain. If your provider is not listed, select Other.
  5. For manual setup, copy the Name (Host) and Value for CNAME 1 and CNAME 2 into your DNS, then click Next.
  6. Copy the DMARC TXT record (Host _dmarc), click Next, and wait for validation.
<CNAME 1 Name from Mailchimp> CNAME <CNAME 1 Value from Mailchimp>
<CNAME 2 Name from Mailchimp> CNAME <CNAME 2 Value from Mailchimp>

The help article does not print the CNAME names or values. They appear in your account. Its troubleshooting example uses k2._domainkey as a Name. If your DNS host turns k2._domainkey.example.com into k2._domainkey.example.com.example.com, enter only k2._domainkey.

As of November 2026, Mailchimp says most records validate "within a few minutes, but this could take up to 48 hours". The domain then shows Authenticated. If you later change the CNAME records, Mailchimp says to disable authentication on the Domains page first and re-authenticate afterwards. If a selector does not resolve, see DKIM not found.

Mailchimp Transactional (Mandrill)

Mailchimp Transactional (Mandrill) has its own setup, documented on mailchimp.com/developer as of November 2026. It "won't send any email from unverified domains or domains without a valid DMARC policy and DKIM records". In the app, go to Settings, then Domains, and add the domain. Then publish:

mte1._domainkey.example.com CNAME dkim1.mandrillapp.com
mte2._domainkey.example.com CNAME dkim2.mandrillapp.com

Domain ownership is proven with a TXT record of the form mandrill_verify.<key>, or by email. The DMARC minimum is v=DMARC1; p=none. The Return-Path points to mandrillapp.com by default. You can add a custom Return-Path subdomain (such as mail.example.com, never the root domain) under Settings, then Tracking & Return Path Domains, with a CNAME to mandrillapp.com.

DMARC alignment

DMARC passes when SPF or DKIM passes and the domain it checked aligns with the From domain. SPF alignment compares the RFC5321.MailFrom (Return-Path) domain with the From domain. DKIM alignment compares the d= domain with the From domain. Relaxed alignment, the default, needs the same organisational domain. Strict needs an exact match.

For Mailchimp marketing mail from [email protected]:

  • SPF. Mailchimp says the envelope sender usually contains a Mailchimp domain such as mcsv.net. That is a different organisational domain from example.com, so SPF does not align there. As of November 2026, the marketing help documents no way to use your own domain in the envelope sender, so plan on SPF not aligning.
  • DKIM before setup. Mailchimp authenticates with its own domain. That signature does not align with example.com, so the message has no aligned identifier. At p=reject, such mail can be rejected.
  • DKIM after setup. The CNAME records sit under _domainkey.example.com, under the two selector names shown in your account (Mailchimp's example uses k2). DKIM works by having the receiver fetch the key from the selector under the d= domain (see DKIM explained), so keys published under example.com mean signatures with d=example.com, which aligns in both modes.

So for Mailchimp marketing mail, DKIM is the documented route to a DMARC pass. (Mailchimp Transactional differs: it documents a custom Return-Path subdomain.) Verify every domain and subdomain you put in the From field, and authenticate it (our reading for subdomains), before you tighten the policy. Mailchimp also notes that, as of November 2026, Gmail and Yahoo require custom authentication and a published DMARC record for senders of more than 5,000 emails a day to their addresses.

Step by step to p=reject

  1. Publish SPF. Keep one TXT record on example.com for your other senders, ending in ~all. Mailchimp's marketing help documents no include for it, so Mailchimp adds no SPF lookups. Its envelope sender usually contains Mailchimp's own domains.
  2. Turn on DKIM. Verify the domain, then start authentication on the Domains tab and publish both CNAME records with the exact Name and Value from your account. Mailchimp's flow shows the DMARC TXT record next, before validation, so publish it in the same pass in the form of step 3.
  3. Publish DMARC with p=none and rua. Check that the DMARC TXT record at _dmarc.example.com is p=none and add your report address, for example v=DMARC1; p=none; rua=mailto:[email protected], then wait until the domain shows Authenticated. Receivers send aggregate reports without acting on failures yet (DMARC policy none is expected here).
  4. Read the reports and fix other senders. Check that Mailchimp sources pass DKIM aligned with example.com. For each other source that fails both SPF and DKIM alignment, set up DKIM with your domain or add it to SPF if its Return-Path uses example.com.
  5. Move to quarantine. When the reports show only legitimate mail passing, change the policy to p=quarantine.
  6. Move to reject. After a period at quarantine without unexpected failures, change the policy to p=reject and keep reading the aggregate reports for new senders.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
_dmarc.example.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

Mailchimp's setup shows a DMARC TXT record for you to copy. If you already have one, keep one record and add the reporting address to it. Some receivers support a test flag (t=y in RFC 9989 (DMARCbis) or pct in RFC 7489), but neither is a safety net: RFC 7489 says unknown tags must be ignored, so a receiver that implements only RFC 7489 can apply p=reject; t=y as a full reject. Step from p=none to p=quarantine to p=reject instead.

Common mistakes

  • Expecting SPF to align. Mailchimp says its envelope sender usually contains its own domains, and its marketing help documents no way to change that. Rely on DKIM for marketing mail.
  • Sending before authentication is done. Until the domain shows Authenticated, mail has no aligned identifier for example.com, so DMARC fails (our reading).
  • The domain added twice to the hostname. Mailchimp's own example: k2._domainkey.example.com.example.com. Enter only k2._domainkey.
  • Editing the CNAME records after authentication. Mailchimp says this can interfere with the authentication it has stored. Disable authentication first, then re-authenticate.
  • Forgetting a subdomain. A sending subdomain needs its own verification (Mailchimp). Authenticate it too (our reading; the help does not say how Mailchimp signs a subdomain).
  • Two DMARC records. Merge the Mailchimp record with any existing one.
  • No report address. Without rua, you cannot see which senders fail. See DMARC without rua.

How to check it

Run the email security check after each step. Use the SPF lookup counter to count the lookups of your SPF record. In the DKIM selector finder, look for the two selectors from your account (Mailchimp's example uses k2), or mte1 and mte2 for Mailchimp Transactional. Build each DMARC stage with the DMARC record generator.

To check a single campaign, open its headers at the recipient. Look for d=example.com in the DKIM-Signature header and dmarc=pass in Authentication-Results.

Sources

Frequently asked questions

Which SPF include does Mailchimp use?

As of November 2026, Mailchimp's help articles for marketing email document no SPF include for your domain. Its setup asks for 2 CNAME records (DKIM) and 1 TXT record (DMARC). Mailchimp says the envelope sender usually contains its own domains, such as mcsv.net, and its marketing help documents no way to use your own domain there. Plan on SPF not aligning for Mailchimp marketing mail and rely on DKIM.

Which DKIM selector does Mailchimp use?

Mailchimp shows the two selector names, with the exact Name (Host) and Value of both CNAME records, in your account during setup. Copy them from there. Its troubleshooting example uses k2._domainkey as a Name.

Why do recipients see "via mailchimpapp.net" or "on behalf of mcsv.net"?

Mailchimp says this appears when your From address has not been authenticated. Authenticating your own domain with DKIM removes it in most email clients, although Mailchimp notes that some, like Outlook, may still show it.

Does Mailchimp Transactional (Mandrill) use the same records?

No. As of November 2026, Mailchimp Transactional uses CNAME records at mte1._domainkey and mte2._domainkey pointing to dkim1.mandrillapp.com and dkim2.mandrillapp.com, a mandrill_verify TXT record, and a DMARC record of at least v=DMARC1; p=none.