Skip to content
inboxprobe

Checkers

Generators

Guides

Guides

SPF, DKIM and DMARC for Mailchimp

Mailchimp asks for three DNS records: two CNAMEs for DKIM and one TXT for DMARC. Here's where to find them, what each does, and how to check they're live.

The records Mailchimp asks for

Mailchimp's help page lists 2 CNAME records for DKIM and 1 TXT record for DMARC. The names and values are specific to your account and shown in Mailchimp's instructions, so copy them from there exactly; don't use values from a blog post or another account.

DKIM, record 1

Type
CNAME
Host / name
<first Name shown in Mailchimp>
Value
<first Value shown in Mailchimp>

DKIM, record 2

Type
CNAME
Host / name
<second Name shown in Mailchimp>
Value
<second Value shown in Mailchimp>

DMARC

Type
TXT
Host / name
_dmarc
Value
<value shown in Mailchimp>

A domain can only have one DMARC record. If _dmarc already has a v=DMARC1 TXT record (from Google Workspace or Microsoft 365, say), keep that one and don't add a second; check it with the DMARC checker.

Some DNS panels add your domain to the end of every name automatically. If yours does, enter only the part before your domain, or you'll end up with a name like …_domainkey.yourdomain.com.yourdomain.com. Mailchimp's troubleshooting section shows this exact mistake.

Where to start in Mailchimp

  1. Make sure the domain is verified: Mailchimp only lets you authenticate a domain it has already verified.
  2. Select your profile icon → Account & billing (or Account if you're a Manager) → Domains.
  3. Next to the domain, select Start authentication, then choose your domain provider and select Next.
  4. Mailchimp recommends its automatic setup (through Entri) where it's offered. Otherwise copy each record into your DNS host's panel.

What about SPF?

Mailchimp's current instructions don't include an SPF record. Mailchimp sends with its own bounce address, on domains like mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net, so SPF is checked for Mailchimp's domain, not yours, and passes there.

That's why the DKIM records matter: they let Mailchimp sign your campaigns with your domain, which is what makes DMARC pass for your From address. In a received campaign you'll see spf=pass for a Mailchimp domain and dkim=pass for yours. Paste the headers into the email header analyzer to see it laid out.

Checking it worked

  • Run the check above. DMARC should show a valid record.
  • In the DKIM checker, enter the part of the first CNAME's name before ._domainkey as the selector. It should find a key through the CNAME.
  • Send a test campaign to a Gmail address, open it → ⋮ → Show original. You want DKIM: PASS with your domain and DMARC: PASS.

Questions

Do I have to authenticate my domain in Mailchimp?

Mailchimp says Gmail and Yahoo require custom authentication and a DMARC record from anyone sending more than 5,000 emails a day to their addresses, and strongly recommends it for everyone else. Without it, some mail apps show your campaigns as sent via Mailchimp's domain.

Should I add include:servers.mcsv.net to my SPF record?

Mailchimp's current setup instructions don't ask for any SPF change. Mailchimp's bounce address is on its own domains, so an include in your SPF record wouldn't affect how your campaigns are checked.

Mailchimp says the records aren't found.

Give DNS time (minutes to a few hours), then look for the doubled-domain mistake: some DNS hosts append your domain to the name. Also check you created CNAME records, not TXT, for DKIM.

Why does Outlook still show “via mcsv.net”?

Mailchimp notes that some email clients, Outlook among them, may still show authentication details after DKIM is set up. If DKIM and DMARC pass in the headers, your setup is right.

Sources

Last reviewed: