Mailchimp Domain Authentication: DKIM & SPF

Mailchimp can send campaigns with your From domain, but until you authenticate it, mail is signed by Mailchimp's infrastructure: receivers see a "via mcsv.net"-style sender, and DMARC fails because the signing domain does not match your From address. Under the Gmail, Yahoo and Microsoft requirements, unauthenticated bulk mail lands progressively further from the inbox — and Mailchimp may rewrite your From address to one of its own domains to keep campaigns deliverable, at the cost of your brand in the sender line.

Authentication is a short DNS task: a few CNAME records from Mailchimp, an SPF include, and a DMARC record you publish yourself. Here is the whole thing, step by step.

What you need

• A Mailchimp account with access to domain settings.
• The domain you send from, with DNS access at your registrar or host. Free-mailbox domains like gmail.com cannot be authenticated.
• Any other senders on the domain in mind, so you can merge everything into a single SPF record.

Configuration steps

1. In Mailchimp, open Website > Domains (or follow the prompt in the campaign builder or audience settings), then click Add & Verify Domain. Verify the domain first — Mailchimp emails a confirmation code to an address on that domain.
2. Start authentication. Mailchimp displays the CNAME records for DKIM, which look like this:

CNAME  k1._domainkey.yourdomain.com  ->  dkim.mcsv.net
CNAME  k2._domainkey.yourdomain.com  ->  dkim2.mcsv.net
CNAME  k3._domainkey.yourdomain.com  ->  dkim3.mcsv.net

Depending on your account, Mailchimp may show only k1 or a k2/k3 pair — the records in your dashboard are authoritative, so publish exactly those, all of them. The CNAME pattern delegates DKIM key publication to Mailchimp, letting it rotate keys without you touching DNS, while every message goes out signed with d=yourdomain.com.

3. Add Mailchimp's SPF include to the domain's single SPF TXT record:

v=spf1 include:servers.mcsv.net ?all

If you already have an SPF record, merge the include into it rather than creating a second record:

v=spf1 include:_spf.google.com include:servers.mcsv.net ?all

4. Publish your DMARC record at the root of the domain:

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

5. Return to Mailchimp and click Check Status / Authenticate. Once the CNAMEs resolve, campaigns are sent with your From domain, signed by your domain.

If your DNS host is supported, Mailchimp's Entri connector can write the records for you — handy if you are not comfortable editing DNS by hand.

Why SPF does not carry DMARC here — and why that is fine

Mailchimp's envelope sender (Return-Path) stays on its own bounce infrastructure so bounces flow back into list management. SPF is checked against that envelope domain, so it passes for Mailchimp's domain and can never align with your From domain — not a misconfiguration you can fix, just how the platform routes bounces.

It is also fine: DMARC passes when either mechanism passes and aligns, and the CNAMEs make DKIM align. The aligned signature even survives most forwarding, which SPF never does. Adding include:servers.mcsv.net authorizes Mailchimp's IPs for your domain, but it does not change the DMARC verdict — and redundant includes eat into the ten-lookup SPF limit.

Verify

Send a test campaign to a Gmail address and open Show original. You want to see DKIM pass with d=yourdomain.com and DMARC pass; SPF will pass for Mailchimp's envelope domain. Paste the headers into the Email Header Analyzer for a structured readout of all three results.

Check the records with the DKIM Checker (domain plus selector k1, k2 or k3), the SPF Checker and the DMARC Lookup, or cover the whole domain in one pass with the Email Health Check. For the fundamentals, see the authentication basics guide.

Common mistakes

• Believing SPF alone passes DMARC. On Mailchimp it never aligns. If your DKIM CNAMEs are missing, no SPF record can rescue the DMARC verdict.
• Publishing only some of the CNAME records. If your dashboard shows k1, k2 and k3, publish all of them. A missing selector means any mail signed with it fails DKIM.
• Creating a second SPF record instead of merging. Two v=spf1 TXT records break SPF for every sender on the domain, including your mailbox provider.
• Publishing CNAMEs as TXT records. The DKIM records are CNAMEs pointing at dkim.mcsv.net; entering them as TXT or A records fails verification.
• Moving DMARC to reject before DKIM is live. Until the CNAMEs are verified, Mailchimp mail does not align — under p=reject it is bounced or junked. Confirm alignment in the aggregate reports with the DMARC Report Analyzer first.

Frequently asked questions

Which records does Mailchimp actually require?

The DKIM CNAME records shown in your account, plus your own DMARC record — the current flow asks for both. The SPF include is optional for delivery, but belongs in a clean SPF setup that authorizes the platform's IPs.

Why did Mailchimp change my From address?

When your From domain is not authenticated, Mailchimp may rewrite the sending address to a domain it controls so campaigns remain deliverable under DMARC enforcement. Authenticate the domain and your address goes back to being used as-is.

Do I need to rotate the DKIM key myself?

No. Because the CNAMEs point at Mailchimp's key infrastructure, Mailchimp handles rotation on its side without DNS changes on yours — one of the quiet advantages of CNAME-delegated DKIM.

Can I use a subdomain for Mailchimp mail?

Yes — authenticate news.yourdomain.com (or similar) and send from it. Subdomains inherit the root domain's DMARC record, and separating campaign mail from other traffic protects both reputations.