How to set up DMARC/DKIM/SPF for Mailchimp
Mailchimp Marketing needs a verified sending domain, two DKIM CNAME records, and one DMARC TXT record. Standard campaigns use a Mailchimp-controlled Return-Path, so SPF can pass for Mailchimp's domain without matching the visible From domain. Do not add a Mailchimp SPF include solely for standard campaigns. Make DKIM pass with your From domain instead, because that gives DMARC the authenticated match it needs.
The exact DKIM names shown in the account take priority over generic examples. Mailchimp commonly supplies k2 and k3 selectors, but older accounts can show different selectors. Keep any existing DMARC quarantine or reject policy in place. A domain with no DMARC policy should start with the monitoring record shown below.
Add your domain
Add the exact domain used after the @ sign in the campaign's From address. A subdomain and its parent are separate sending domains, so authenticate each one that Mailchimp uses.
- Open Domains. Sign in to Mailchimp, select the profile icon, choose Account & billing, and open the Domains tab.
- Verify access. Add the From email address if its domain is absent, then use the verification email or code to prove access.
- Start authentication. Select Start authentication next to the verified domain, choose the DNS host, and continue with automatic or manual setup.
- Copy account values. Keep the Mailchimp instructions open. Copy each host, record type, and target exactly as displayed.
Domain verification only proves access to an address. It does not authenticate delivered campaigns. The Authenticated label appears only after Mailchimp finds the required DNS records. Mailchimp documents both steps in its domain authentication instructions.
Mailchimp Domains page with Start authentication selected
For several From domains, repeat verification and authentication for every domain. The same account can hold multiple domains, but one domain's CNAME records do not authenticate another. The process for a larger set of domains is covered in the multiple Mailchimp domains guide.
Set up SPF
Do not add include:servers.mcsv.net to the visible From domain's SPF record solely for standard Mailchimp Marketing campaigns. Mailchimp uses an Envelope From or Return-Path under its own sending domains, so the receiver checks Mailchimp's SPF policy. That SPF result does not match your visible From domain for DMARC.
SPF does not authenticate your Mailchimp From domain
Expect DMARC reports to show SPF as unaligned for standard campaigns. That result is acceptable when Mailchimp signs with DKIM using the same organizational domain as the visible From address.
- Keep one record. A domain must publish no more than one SPF TXT record.
- Protect other mail. Retain mechanisms needed by systems that send with your domain in the Return-Path.
- Avoid wasted lookups. An unused Mailchimp include consumes SPF DNS lookup capacity without making campaign SPF match the From domain.
- Rely on DKIM. Mailchimp Marketing campaigns should pass DMARC through DKIM.
Check the existing root-domain SPF record before changing it. If include:servers.mcsv.net is present, confirm that no separate mail stream depends on it, then remove it when it was added only for standard Mailchimp campaigns. Do not replace the entire SPF record because that can disable authentication for other authorized senders.
Mailchimp Transactional has separate authentication controls and supports a custom return-path subdomain. Use its authentication and delivery documentation when the account sends transactional mail rather than standard Marketing campaigns.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
Run the checker against the visible From domain. Resolve multiple SPF records, syntax errors, and more than 10 DNS-causing lookups. A clean SPF record still will not make standard Mailchimp campaign SPF match your domain, so the next step is mandatory.
Set up DKIM
DKIM is the path that makes standard Mailchimp Marketing campaigns pass DMARC for your From domain. Publish both CNAME records shown by Mailchimp. Do not convert them to TXT records or copy selectors from another account.
- Open the wizard. On the Domains page, select Start authentication or Resolve beside the sending domain.
- Choose manual setup. Select the DNS host, choose manual authentication, and advance to the two CNAME values.
- Create both CNAMEs. Add each Mailchimp host and target exactly. Use the host without the root domain when the DNS control panel appends it automatically.
- Leave them published. The CNAME delegation lets Mailchimp manage its public keys and rotate signing keys without another DNS change.
Typical Mailchimp DKIM recordsDNS
k2._domainkey.example.com CNAME dkim2.mcsv.net k3._domainkey.example.com CNAME dkim3.mcsv.net
These are common examples, not universal account values. Use the selector names and targets displayed in Mailchimp. Some DNS control panels want k2._domainkey as the host, while others accept the full name. The final public name must resolve once, without example.com repeated.
Mailchimp manual authentication screen with two DKIM CNAME records
Correct DNS result
- Record type. Both records are CNAMEs.
- Public host. Each selector appears once before the sending domain.
- CNAME target. The target ends in mcsv.net and resolves publicly.
- Mail signature. Delivered mail has d= set to your domain or its parent.
Common failure
- Duplicate suffix. The DNS host appends the domain to a full host name.
- Proxy enabled. The DNS service masks the CNAME instead of returning it.
- Wrong record type. A TXT value was created where Mailchimp requested CNAME.
- Stale selector. DNS contains values copied from an older account setup.
Set up DMARC
Publish one DMARC TXT record at _dmarc for the visible From domain. If the domain has no DMARC record, start with p=none and send aggregate reports to a monitored mailbox. If the domain already uses p=quarantine or p=reject, keep that policy and fix Mailchimp DKIM instead of weakening enforcement.
Starting DMARC recordDNS
v=DMARC1; p=none; rua=mailto:dmarc@example.com
- Check for DMARC. Query _dmarc.example.com before adding anything. Edit the existing record when one exists.
- Create one TXT. Use _dmarc as the host when the DNS panel appends the domain, then paste the record value.
- Use a real mailbox. Replace dmarc@example.com with an address that receives aggregate XML reports or forwards them to a reporting platform.
- Preserve enforcement. Do not replace p=quarantine or p=reject with p=none when authenticated campaigns already pass.
The DMARC record generator can build a valid record with reporting and optional policy controls. Publish the generated value only after confirming that it will not create a second DMARC record.
Mailchimp DMARC step with a monitoring TXT record
Mailchimp checks that a syntactically valid DMARC policy exists. Receivers then use it to evaluate whether SPF or DKIM both pass and match the visible From domain. For standard Marketing campaigns, the expected successful path is DKIM.
Run the domain through the checker after public DNS returns the TXT value. The result should show one record, version DMARC1, a recognized policy, and a valid aggregate reporting address.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Never publish two DMARC records
Two TXT records beginning with v=DMARC1 make DMARC invalid. Merge the required tags into one record at _dmarc and remove the duplicate only after confirming which record contains the current reporting and enforcement settings.
Verify and troubleshoot
Return to Mailchimp after DNS publishes the records. Mailchimp often validates within minutes, but its support documentation allows up to 48 hours. A domain is ready only when the Domains page shows Authenticated and a delivered campaign has DKIM pass for your domain.
- Check status. Open Account & billing, select Domains, and inspect the domain status. Use Resolve or Restart authentication after correcting a failed setup.
- Query public DNS. Confirm that both selector names return the expected CNAME targets and _dmarc returns one TXT record.
- Send a campaign. Send to a mailbox you control, open the raw headers, and find dkim=pass with header.d set to your domain or its organizational parent.
- Read DMARC results. Accept SPF mismatch for standard campaigns only when DKIM passes and the final DMARC result is pass.
Public DNS checksBASH
dig CNAME k2._domainkey.example.com +short dig CNAME k3._domainkey.example.com +short dig TXT _dmarc.example.com +short
|
|
|
|---|---|---|
CNAME missing | Domain repeated | Shorten host |
Wrong target | Old selector | Copy current value |
DMARC invalid | Duplicate TXT | Merge records |
SPF mismatch | Mailchimp Return-Path | Confirm DKIM pass |
Common Mailchimp authentication failures
A header test catches problems that a DNS-only check misses, including a campaign signed with Mailchimp's domain instead of yours. Send a real campaign after Mailchimp shows Authenticated, because saved DNS records alone do not prove that the active mail stream uses them.
Mailchimp domain marked verified and authenticated
Use the email tester for the quickest end-to-end check. Send the requested test message directly from a Mailchimp campaign, then inspect the reported SPF domain, DKIM signing domain, DMARC outcome, and visible From address.
A healthy standard Mailchimp result can show SPF pass for a Mailchimp-controlled domain, SPF mismatch against your From domain, DKIM pass for your domain, and DMARC pass. The DKIM and DMARC results are the decisive pair.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
If DKIM still uses a Mailchimp domain, confirm that the campaign From address exactly matches the authenticated domain. Then reopen the Domains page, verify both CNAMEs, and send a new campaign rather than rechecking an older message.
Get alerted when it breaks
DNS checks prove the configuration only at one moment. A deleted CNAME, a changed From domain, an expired sending source, or a new unauthorized sender can break DMARC later. Continuous aggregate-report analysis is the reliable control.
For this workflow, Suped is the best overall practical DMARC platform for most teams. Suped is our product, and its DMARC monitoring collects aggregate reports, identifies Mailchimp traffic, detects authentication changes, and sends real-time alerts with steps to fix the issue.
Manual checking
- Timing. A failure stays hidden between checks.
- Reports. Raw XML must be collected and interpreted.
- Attribution. IPs and sending domains need manual source mapping.
- Scale. Every extra domain adds another review queue.
Suped monitoring
- Detection. Authentication failures and volume changes surface automatically.
- Alerts. Real-time notifications show which domain and source changed.
- Resolution. Automated issue detection includes practical fix steps.
- Coverage. DMARC, SPF, DKIM, deliverability, and blocklist (blacklist) signals appear together.
Configure alerts for a rise in DMARC failures, a new unverified source, or a drop in Mailchimp DKIM pass rate. Weekly summaries help catch low-volume drift that stays below an urgent alert threshold.
Alert on the authenticated result
Track Mailchimp by source and DKIM signing domain, not by SPF mismatch alone. Standard Marketing traffic can keep showing SPF mismatch while remaining fully DMARC-compliant through DKIM.
Secure your domain with p=reject
Move to p=reject after every legitimate sender has been identified and Mailchimp shows consistent DKIM-based DMARC passes. Do not wait for standard Mailchimp SPF to match the From domain, because that is not its normal authentication path.
- Collect reports. Run p=none through at least one normal sending cycle, including scheduled campaigns and low-volume sources.
- Classify sources. Mark Mailchimp and every other legitimate stream as authorized, then investigate unknown traffic before enforcement.
- Fix DKIM failures. Require Mailchimp DKIM to pass for the same organizational domain as the visible From address.
- Stage quarantine. Use p=quarantine with a limited pct value, review results, and increase coverage through full quarantine.
- Stage rejection. Move to p=reject with limited coverage, review legitimate failures, and then set pct=100.
DMARC enforcement readiness
Use authorized-mail DMARC pass rate and source classification to decide the next policy action.
Unknown
Stay at p=none
Traffic is not classified or a normal sending cycle is incomplete.
Investigate
Fix authentication
Legitimate sources still fail DMARC or Mailchimp DKIM is inconsistent.
Stage
Use quarantine
Authorized mail passes consistently and unknown traffic has been reviewed.
Enforce
Set p=reject
Policy trials show no unresolved legitimate failures.
For this enforcement workflow, Suped is the best overall practical choice for most teams because it identifies verified and unverified sources, shows pass rates, detects policy risks, and provides steps to fix each issue. Its Hosted DMARC controls support staged policy changes without repeated manual TXT edits.
p=reject readiness check
- Mailchimp. Recent campaigns pass DKIM and DMARC for the intended From domain.
- Other senders. Every legitimate source has a working DMARC authentication path.
- Subdomains. The subdomain policy matches how mail is actually sent.
- Monitoring. Alerts remain active after pct=100 so later breakage is caught quickly.
Mailchimp authentication FAQ
These checks cover the cases that most often cause confusion after Mailchimp reports a domain as authenticated.
