Set up SPF, DKIM and DMARC on Mailchimp

Mailchimp does not replace your mail host — it sends alongside it. Add its SPF include, publish the two DKIM CNAMEs, set DMARC, then click Authenticate.

Check your setup free → Mailchimp docs ↗

Before you start

What Mailchimp needs from your DNS.

Mailchimp is a sending platform, not your mailbox host, so authenticating it means adding to the DNS you already have rather than swapping anything out. You keep sending normal mail through Google Workspace, Microsoft 365 or whoever hosts your inbox, and you tell the world that Mailchimp is also allowed to send as your domain. Get that wrong and your campaigns land in spam or bounce outright.

The work is three records at your DNS host. SPF gains one include so Mailchimp's servers are authorised, DKIM is delegated through two CNAME records that point at Mailchimp so it can sign and rotate keys for you, and DMARC ties it together on your root domain. Mailchimp uses CNAME delegation rather than a pasted public key, which is why you copy the two CNAME values straight from the Domains page instead of generating anything yourself.

Since February 2024 Google and Yahoo require bulk senders to Gmail and Yahoo inboxes to pass SPF, DKIM and DMARC. Authenticating your domain in Mailchimp is no longer optional polish — an unauthenticated domain is throttled or blocked at exactly the receivers your campaigns need to reach.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not Mailchimp. Then run the checker to confirm every one resolves.

SPF record

host @ type TXT

v=spf1 include:servers.mcsv.net ~all

You almost certainly already have an SPF record for your mailbox host. Do not publish a second one — edit the existing line and insert include:servers.mcsv.net before the terminating ~all or -all, e.g. v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. Two SPF records is a permerror that voids both.

DKIM (CNAME 1) record

host k1._domainkey type CNAME

dkim.mcsv.net

Mailchimp delegates DKIM rather than giving you a key to paste. Copy the exact Name and Value for CNAME 1 from your Mailchimp Domains page — the host is typically k1._domainkey and the target dkim.mcsv.net, but confirm both against what Mailchimp shows for your account. Some DNS panels append your domain twice; if k1._domainkey.example.com.example.com appears, shorten the name to k1._domainkey.

DKIM (CNAME 2) record

host k2._domainkey type CNAME

dkim2.mcsv.net

The second delegation record. Copy the exact Name and Value for CNAME 2 from your Domains page — usually k2._domainkey pointing to dkim2.mcsv.net. Both CNAMEs must resolve before Mailchimp will mark the domain authenticated.

DMARC record

host _dmarc type TXT

v=DMARC1; p=none; rua=mailto:[email protected]

Published once on your root domain, covering every sender including Mailchimp. Start at p=none to watch alignment without risk, then raise to quarantine and reject once your reports show Mailchimp and your mailbox host both aligning. Point rua at an address you read.

Step by step

The whole setup, in order.

1 Start domain authentication in Mailchimp. In Mailchimp go to your profile, then Settings, then Domains, and choose to authenticate the domain you send from. Mailchimp will display the two DKIM CNAME records and the DMARC TXT record, each with a Name (Host) and Value you copy.
2 Add Mailchimp to your existing SPF. At your DNS host, open the SPF TXT record you already have for your mailbox provider and insert include:servers.mcsv.net just before the terminating ~all or -all. If, and only if, you have no SPF record at all, publish v=spf1 include:servers.mcsv.net ~all at the root.
3 Publish the two DKIM CNAMEs. Add both CNAME records exactly as Mailchimp shows them — k1._domainkey and k2._domainkey pointing to Mailchimp's targets. These are CNAMEs, not TXT records; picking the wrong type is the most common reason authentication never completes.
4 Publish DMARC on the root domain. Add the _dmarc TXT record at your root domain. Begin at p=none with a working rua address so you break nothing while you confirm every legitimate sender aligns.
5 Click Authenticate, then verify. Return to the Mailchimp Domains page and run Check Status. Propagation can take up to 48 hours depending on your DNS provider. Once it passes, run a full check here to confirm SPF stays under the 10-lookup limit, both DKIM CNAMEs resolve, and DMARC is graded.

Where it goes wrong

The mistakes specific to Mailchimp.

Replacing your SPF instead of adding to it Mailchimp does not host your mailbox. If you overwrite your existing SPF with only include:servers.mcsv.net, your normal mail from Google Workspace or Microsoft 365 starts failing SPF. Add the include to the line you already have.

A second, separate SPF record Publishing v=spf1 include:servers.mcsv.net ~all as a new record next to your existing SPF is a permerror that invalidates both. A domain may carry exactly one SPF record.

DKIM added as TXT instead of CNAME Mailchimp delegates DKIM via CNAME so it can rotate keys without you. Adding the value as a TXT record, or pasting it into a key field, leaves the domain unauthenticated.

The domain doubled in the CNAME name Some panels auto-append your domain, turning k1._domainkey into k1._domainkey.example.com.example.com. Enter just k1._domainkey (or the host part) so the final name resolves correctly.

Guessing the CNAME targets The k1/k2 host names are standard, but always copy the exact Name and Value from your own Domains page rather than trusting an example — a mistyped target silently fails DKIM.

Checking before propagation Running Check Status minutes after publishing shows a failure that is only DNS propagation. Give it up to 48 hours before concluding anything is wrong.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the Mailchimp DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About Mailchimp, specifically.

What is the Mailchimp SPF record? Mailchimp's SPF mechanism is include:servers.mcsv.net. You do not publish it on its own — add it to your existing SPF record before the terminating ~all, for example v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. Never create a second SPF record.

What is the Mailchimp DKIM selector? Mailchimp uses two CNAME records at k1._domainkey and k2._domainkey, delegated to Mailchimp's servers (typically dkim.mcsv.net and dkim2.mcsv.net). Because it is CNAME delegation, you copy the exact values from your Mailchimp Domains page rather than pasting a public key.

Why is my Mailchimp DKIM failing? Usually one of three things: the records were added as TXT instead of CNAME; your DNS panel doubled the domain onto the k1._domainkey name; or you are checking before propagation, which can take up to 48 hours. Copy both CNAMEs exactly as Mailchimp shows them and re-run Check Status.

Do I need to change my SPF record for Mailchimp? Yes — edit your existing SPF to include servers.mcsv.net so Mailchimp is authorised alongside your mailbox host. Do not replace your current SPF or add a second record; both break authentication.

Do I need DMARC for Mailchimp? Yes if you send in bulk to Gmail or Yahoo, which have required it since February 2024. Publish one _dmarc TXT record on your root domain at p=none, then raise it to quarantine and reject once reports show Mailchimp and your other senders aligning.

How long does Mailchimp domain authentication take? Once the records are published, propagation takes anywhere from a few minutes to 48 hours depending on your DNS provider. Use Mailchimp's Check Status tool to confirm, and do not conclude it has failed until that window has passed.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring