Back to Learning Center Email Authentication

How do I set up SPF and DKIM for Mailchimp?

By Johanie DupontAugust 10, 202611 min read

Ask AI to explain

In brief

Mailchimp SPF and DKIM setup: authenticate a sending domain with Entri or two CNAME records, preserve SPF, add DMARC, and validate a campaign.

Set up Mailchimp domain authentication from Account & billing > Domains: verify the sending domain, select Start authentication, then use Entri or publish the records Mailchimp displays for that domain. Mailchimp's current manual workflow uses two account-specific CNAME records and a DMARC TXT record. It does not document a separate Mailchimp SPF record at the root domain, so preserve an existing SPF policy unless your account presents a specific change.

At a glance

Quick takeaways

Mailchimp domain verification proves access to an address, while authentication configures DNS for the sending domain.
Mailchimp recommends Entri when it supports your DNS provider and you can authorize the change.
Manual authentication requires two account-specific CNAME records and a DMARC TXT record.
Do not add a second SPF TXT record at the root domain because multiple SPF records can cause SPF evaluation problems.
A Mailchimp Authenticated status does not prove that a delivered campaign passed DKIM or DMARC.
Validate DNS, Mailchimp status, a newly delivered campaign, and DMARC reports as separate checks.

What should I check before configuring Mailchimp?

This workflow covers a domain your organization owns and uses in Mailchimp campaign From addresses. Confirm that the domain has already completed Mailchimp verification and that you can edit its authoritative DNS zone. Mailchimp distinguishes domain verification from domain authentication in its email domain authentication instructions.

Check which system sends the messages in scope. This guide covers Mailchimp campaign mail. It does not confirm authentication for transactional mail, employee mail, a CRM, or another platform that uses the same visible From domain. Record the selected Mailchimp account, sending domain, DNS zone, DNS approver, and mailbox for the production test.

Review existing root-domain SPF and _dmarc TXT records before making changes. Mailchimp's documented manual method does not provide a root SPF record. An SPF policy is a single TXT record at its owner, so do not create another one to satisfy a generic SPF setup request.

Copy DNS values from the account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example.

For background on how these controls work together, see what email authentication means for senders.

Which setup method should I use?

Use Entri if Mailchimp offers it for your DNS provider and you are permitted to authorize the connection. Mailchimp describes Entri as its recommended method. Review the selected domain and proposed records before you approve the DNS connection.

Use manual authentication when Entri is unavailable, when your DNS provider is not supported, or when DNS changes must go through a separate change-control process. Keep the Mailchimp instructions open while editing DNS. The CNAME names and targets are generated for the selected account and domain.

The Mailchimp manual screen below shows the two CNAME rows that the account provides. These values are examples from the documented interface, not reusable records.

How do I configure SPF and DKIM for Mailchimp?

1. Open the sending-domain settings

In Mailchimp, open Account & billing, select Domains, find the verified sending domain, and select Start authentication. This path is documented by Mailchimp, rather than inferred from an older interface.

Verify the selected domain before proceeding. An account can contain more than one verified domain, and the authentication records belong to the domain you selected.

2. Choose Entri or manual authentication

Select Entri when Mailchimp offers the option and your organization authorizes it. Sign in to the DNS provider only through the provider connection shown by Mailchimp, then review the domain and records before confirming.

For a manual change, select Or manually authenticate your domain, choose the DNS provider if Mailchimp asks, and copy the record instructions for the selected domain. Do not replace an existing authentication record merely because an online example uses a similar host name.

3. Publish the two Mailchimp CNAME records

Mailchimp's manual authentication instructions provide two CNAME Name and Value pairs. Publish both pairs exactly as shown in the account.

First record

Record type: CNAME
Host: the first Mailchimp-generated Name or Host
Value: the matching Mailchimp-generated Value or Points To target

Second record

Record type: CNAME
Host: the second Mailchimp-generated Name or Host
Value: the matching Mailchimp-generated Value or Points To target

The record shape below is illustrative only. Generate the actual names and targets in the Mailchimp account for the domain being authenticated.

Technical exampletext

CNAME
host: k1._domainkey.yourdomain.com
value: k1.domainkey.example-mailchimp-target.net

Do not publish this example. Copy both complete CNAME records from Mailchimp. They are account-specific and a target from another account will not authenticate your domain.

Watch for the DNS-provider suffix trap. Some DNS interfaces append yourdomain.com after the value entered in the Host field. If you paste a full owner name into a field that expects only the relative label, the published owner can contain the domain twice. Check the final fully qualified name after saving.

4. Review the DMARC TXT record without creating duplicates

Mailchimp's manual workflow also presents a DMARC TXT record step. The screen below shows the DMARC record area in that workflow.

Check whether _dmarc.yourdomain.com already has a valid TXT record. DNS should publish one DMARC policy at that owner. Do not create a second record or overwrite reporting addresses, alignment settings, subdomain policy, or enforcement settings without approval from the domain owner.

A structural DMARC example looks like this:

Technical exampletext

TXT
host: _dmarc.yourdomain.com
value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Do not publish this example as your production policy. Use the record Mailchimp displays only after comparing it with the existing domain policy and its approved reporting destination.

5. Confirm authentication and send a new campaign

Return to Account & billing > Domains after public DNS answers for the records. Mailchimp can show Authentication in progress while it validates, then Authenticated after its checks pass. Mailchimp documents that authentication can take up to 48 hours.

After the domain shows Authenticated, send a new campaign from the exact production account and From address to a mailbox where you can inspect raw source. Do not use a message sent before the DNS change or a test from another sending platform.

How does this setup affect DMARC?

DMARC evaluates whether SPF or DKIM passes with an identifier aligned to the visible From domain. RFC 9989 defines DMARC alignment and evaluation. For a Mailchimp campaign, the delivered message determines whether the Mailchimp DKIM signature passed and whether its d= domain aligned with the visible From domain.

Do not infer a Mailchimp root SPF change from this article's title. Follow the record set displayed by the current Mailchimp account. If another service sends mail as the same domain, its SPF and DKIM configuration requires its own review. The related Amazon SES SPF and DKIM setup guide illustrates why vendor record sets differ.

Use the DMARC checker to inspect the published DMARC record before any approved policy change. A public lookup does not show which Mailchimp campaign path signed a message, a receiver's private decision, or future inbox placement.

How do I validate the setup?

Check public DNS

Query the exact two CNAME owners Mailchimp generated and the DMARC owner. Compare the returned CNAME targets with the current Mailchimp instructions. A DKIM record check can help inspect public selector evidence, but it does not prove that Mailchimp used the selector for a campaign.

Terminalbash

dig +short CNAME <first-mailchimp-owner>
dig +short CNAME <second-mailchimp-owner>
dig +short TXT _dmarc.<sending-domain>

Check the authoritative DNS answer and at least one public resolver. If either CNAME owner has the domain appended twice, correct the DNS host field before restarting authentication.

Check the Mailchimp status

Return to Account & billing > Domains and confirm that the selected domain shows Authenticated. This confirms that Mailchimp accepted the DNS configuration it checked. A green status is not a delivered-message check and does not show whether every path using the domain authenticates.

Inspect a delivered message

Open raw source for the new campaign in the receiving mailbox. Look for DKIM-Signature and compare its d= and s= values with the expected Mailchimp path. Then inspect the receiver-added Authentication-Results field. RFC 8601 defines Authentication-Results and its trust boundary.

Accept the change only when the trusted receiver result reports dkim=pass and the passing DKIM domain aligns with the visible From domain when DKIM is expected to satisfy DMARC. Keep a redacted copy of the headers with the DNS change record.

Review DMARC reports

After aggregate reports accumulate, confirm that Mailchimp appears as an expected source and that its traffic passes aligned SPF or DKIM. Review every other source using the same domain separately. A correct Mailchimp configuration does not inventory the other platforms that can send as the domain.

Troubleshooting

Mailchimp still shows Authentication in progress

Wait for the public DNS records to answer, then allow the validation window Mailchimp documents. Compare each public CNAME target against the full account-generated value. Do not repeatedly replace records while DNS propagation or Mailchimp validation is still pending.

Mailchimp asks me to resolve or restart authentication

Check the selected domain, both CNAME owners, both targets, and the DMARC owner. A wrong owner name, truncated target, or duplicate domain suffix can prevent validation. Correct the published DNS record first, then use Mailchimp's documented restart option if it remains necessary.

The CNAME owner contains the domain twice

Your DNS provider likely appended the zone name to a full domain entered in a relative Host field. Delete or correct only the malformed owner after confirming the intended record. Enter the label format required by your DNS provider, then verify the final public owner name.

The domain is verified but not authenticated

Verification and authentication are separate Mailchimp states. Return to Domains, select the verified domain, and begin the authentication workflow. Verification alone does not publish the CNAME records or establish a DKIM signing result.

DKIM passes but DMARC fails

Compare the visible From domain with the DKIM d= domain in the delivered campaign's headers. A valid DKIM signature can still fail DMARC if it does not align. Also inspect other sources sending as the domain, because their traffic may account for the DMARC failure.

Check the wider authentication posture after Mailchimp is verified

After Mailchimp shows Authenticated and a delivered campaign has passed the message check, run the domain through the Email Security Score to inspect the public authentication posture around that sending domain. This follows the Mailchimp setup because other platforms can still send as the same domain and create alignment issues.

Check the email security score

A public score does not prove that Mailchimp signed a production campaign, repair another sender, monitor later DNS drift, or guarantee delivery. For ongoing DMARC aggregate-report analysis across Mailchimp and other sources, Palisade is agentic DMARC software that identifies sending sources and prioritizes authentication and alignment issues. A human reviews the evidence and applies policy changes. Start with Palisade.

Evidence

Sources and further reading

For a provider-specific implementation of these authentication checks, see Why does Mailchimp DMARC alignment not require adding Mailchimp to SPF?.

Questions readers ask

Frequently asked questions

Do I need to add an SPF record for Mailchimp?

No. Mailchimp's current manual domain authentication workflow documents two account-specific CNAME records and a DMARC TXT record. It does not instruct you to add a separate Mailchimp SPF policy at the root domain. Preserve the existing SPF record unless the current Mailchimp account provides a specific DNS change.

Is Mailchimp domain verification the same as authentication?

No. Domain verification confirms that you can access an email address at the domain. Authentication is the separate DNS workflow that uses Entri or Mailchimp's manual record instructions.

Should I use Entri or manual authentication in Mailchimp?

Only use Entri when Mailchimp offers it for your DNS provider and you can approve the connection. Use manual authentication when Entri is unavailable or your organization requires a DNS administrator to publish records through its normal change process.

Can I authenticate more than one Mailchimp sending domain?

Yes. Authenticate each verified sending domain from its own Mailchimp Domains entry. Treat each domain as a separate DNS change because its account-generated CNAME values and existing DMARC policy can differ.

How long does Mailchimp authentication take?

Mailchimp documents that domain authentication can take up to 48 hours. Check that the records answer publicly and match the account-provided values before restarting the workflow.

Does an Authenticated status prove my campaigns pass DMARC?

No. The status shows that Mailchimp accepted the DNS configuration it checked. Send a new campaign, inspect the receiver-added Authentication-Results header, and review DMARC aggregate reports after data accumulates.

Work through Mailchimp SPF and DKIM issues in Palisade

Start in Palisade.

Get started

Share this article

Written by

Johanie Dupont

Brand & Ecommerce Email

Johanie Dupont works on brand and ecommerce email at Palisade: BIMI and verified marks, sender requirements, and getting marketing mail into the inbox.