Mailchimp: SPF, DKIM & DMARC Setup

SPF for Mailchimp

Add include:servers.mcsv.net to your domain's single SPF TXT record, never publish two SPF records. If you send only through Mailchimp, the whole record is:

v=spf1 include:servers.mcsv.net ~all

SPF for Mailchimp is optional and is NOT the record surfaced in Mailchimp's current domain-authentication UI (which asks for the DKIM CNAMEs + a DMARC TXT). If you keep or add SPF, the correct, current mechanism is include:servers.mcsv.net (older include.mcsv.net / include:mailchimp.com forms are deprecated). CRITICAL: SPF does NOT achieve DMARC alignment on Mailchimp. Mailchimp sends with an envelope-from / Return-Path on its own bounce domain (mcsv.net space), so SPF authenticates Mailchimp's domain, not yours, the aligned identifier that satisfies DMARC comes from DKIM. Adding include:servers.mcsv.net therefore does nothing for DMARC pass/fail; its only value is legacy receivers that check SPF in isolation. If you send through several providers, count the lookups: servers.mcsv.net expands and eats into the 10-DNS-lookup SPF cap, do not stack redundant includes.

DKIM for Mailchimp

In Mailchimp go to Website (or the account/domain area) → Domains → Add & verify domain, or Audience → Settings → then use 'Set up email domain authentication' / 'Fix it' next to your verified sending domain. Verify ownership of the domain first (Mailchimp emails a verification code or you use the Entri connector). Mailchimp then displays the CNAME records unique to your domain (the current flow typically shows 2, but the exact set is account-generated and can vary). Publish each at your DNS host as a CNAME record (NOT TXT) exactly as Mailchimp shows it, then click 'Check Status' in Mailchimp. The host/target pattern is kN._domainkey.yourdomain → dkimN.mcsv.net (k1 → dkim.mcsv.net, k2 → dkim2.mcsv.net, k3 → dkim3.mcsv.net); k1 is often the primary record and Mailchimp will tell you if additional selectors are needed. DKIM only becomes active once Mailchimp verifies the CNAMEs resolve, publishing alone is not enough; you must return and confirm authentication (propagation can take up to 48h). Mailchimp now strongly pushes 'Entri' one-click automated setup, which writes the records into supported DNS providers for you. IMPORTANT: use the exact selectors and targets Mailchimp shows for YOUR account rather than copying generic examples, the record names vary slightly between accounts.

Method: CNAME · Selector(s): k1, k2, k3

k1._domainkey.yourdomain.com.  CNAME  dkim.mcsv.net
k2._domainkey.yourdomain.com.  CNAME  dkim2.mcsv.net
k3._domainkey.yourdomain.com.  CNAME  dkim3.mcsv.net
(use the exact records Mailchimp displays for your domain, it may show only a subset such as k1 alone or k2/k3)

DMARC for Mailchimp

Publish DMARC at _dmarc.yourdomain.com as a TXT record: Mailchimp's current flow explicitly asks for it alongside the DKIM CNAMEs, and Gmail/Yahoo REQUIRE a DMARC record for bulk senders (>5,000 msgs/24h). Because Mailchimp does NOT support SPF alignment (envelope-from is a Mailchimp bounce domain), your DMARC pass depends entirely on DKIM alignment, so the DKIM CNAMEs MUST be live and verified before you move DMARC past p=none, or legitimate campaigns will fail DMARC. DKIM does align (d= is your domain), so relaxed alignment (default) passes; you generally don't need strict. Start at p=none with rua reporting, confirm Mailchimp mail shows dkim=pass AND aligned in aggregate reports, then tighten to quarantine/reject. If your org DMARC is at reject and DKIM isn't yet authenticated in Mailchimp, campaigns bounce/junk immediately.

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r

Common Mailchimp mistakes

• SPF alone will NOT make DMARC pass on Mailchimp. Mailchimp's Return-Path/envelope is its own bounce domain, so SPF authenticates Mailchimp, not you, DMARC alignment comes only from DKIM. Never rely on include:servers.mcsv.net to satisfy DMARC; get the DKIM CNAMEs verified.
• Publishing the DKIM CNAMEs is not the same as enabling DKIM. You must return to Mailchimp and click 'Check Status'/verify, authentication only activates after Mailchimp confirms the records resolve.
• CNAME-vs-TXT confusion: the DKIM records are CNAME records pointing to dkim.mcsv.net / dkim2.mcsv.net / dkim3.mcsv.net. If you paste them as TXT records (or paste a raw public key) they will never validate.
• Host-field double-domain error: many DNS panels auto-append your domain, so enter the host as 'k1._domainkey' (not 'k1._domainkey.yourdomain.com') or you'll create k1._domainkey.yourdomain.com.yourdomain.com.
• Using outdated SPF includes (include.mcsv.net / include:mailchimp.com): the current SPF mechanism, if used at all, is include:servers.mcsv.net. For DKIM, copy the exact selectors/targets Mailchimp shows; do not assume a fixed k1-only or k2/k3-only scheme, as the account-generated set varies.
• Stacking redundant SPF includes and blowing the 10-lookup limit, servers.mcsv.net expands; if you already authenticate other senders, adding it can push SPF to permerror. Flatten/consolidate instead.
• Tightening DMARC to p=quarantine/reject BEFORE the DKIM CNAMEs are verified. With no SPF alignment, un-verified DKIM means every Mailchimp campaign fails DMARC and gets junked or rejected.

Verify & related