# How do I set up SPF and DKIM for Mailchimp?

> Authenticate a Mailchimp sending domain with the current Entri or manual workflow, two DKIM CNAME records, DMARC, and delivered-message checks.

To set up authentication for Mailchimp, first verify the sending domain, then open `Account & billing > Domains` and select `Start authentication`. Use Mailchimp's recommended Entri connection or choose manual authentication. The current manual workflow displays two account-specific CNAME records for DKIM and one TXT record for DMARC. It does not instruct you to publish a separate Mailchimp SPF record at the root domain. Copy only the values shown for your domain.

## Quick takeaways

- Mailchimp domain verification and domain authentication are different steps.
- Entri is the recommended automatic method in Mailchimp's current workflow.
- Manual authentication displays two account-specific DKIM CNAME records and one DMARC TXT record.
- Do not create a second root SPF policy just because the search query mentions SPF.
- An `Authenticated` label does not replace a delivered-campaign header check or DMARC reporting.

## What should I check before configuring Mailchimp?

This guide covers a business-owned domain used in Mailchimp campaigns. Public mailbox domains such as Gmail and Yahoo cannot be authenticated because you do not control their DNS. Confirm that the selected From address uses a domain your organization owns and that Mailchimp has already verified it through an email link or code.

You need access to `Account & billing > Domains` and permission to edit the authoritative DNS zone. Mailchimp's [current email-domain authentication guide](https://mailchimp.com/help/set-up-email-domain-authentication/) distinguishes verification from authentication and gives the current account path, Entri workflow, manual record set, status labels, and troubleshooting guidance.

Review the existing SPF and DMARC records before editing DNS. Mailchimp's current manual instructions show two CNAME records and one DMARC TXT record. They do not tell the reader to replace the existing root SPF policy or create a second SPF record.

> Copy account-specific DNS values from the Mailchimp account and domain you are configuring. Never publish CNAME owners, targets, verification data, or DMARC values from another account or an online example. Preserve the domain's existing SPF and DMARC configuration unless the current account workflow calls for a deliberate change.

## Which setup method should I use?

Use Entri when Mailchimp offers it for your DNS host and you are authorized to approve the changes. Entri connects to the DNS provider and creates the required records. Review the records and domain before confirming the connection.

Choose `Or manually authenticate your domain` when automatic connection is unavailable or your organization requires DNS change control. Select the DNS provider, keep the Mailchimp instructions open, and copy each host and target exactly. Some providers expect a relative owner label and append the zone automatically.

## How do I set up SPF and DKIM for Mailchimp?

### 1. Verify the sending domain

Complete Mailchimp's domain verification before starting authentication. Verification confirms access to an address on the domain. It does not publish DKIM or prove that a campaign will pass DMARC.

### 2. Open the domain authentication workflow

Select the profile icon, open `Account & billing`, and choose the `Domains` tab. Find the verified domain and select `Start authentication`. Choose the DNS provider from the list or select `Other`, then continue.

### 3. Choose Entri or manual setup

For Entri, select `Continue`, sign in to the DNS provider when prompted, and review the records before authorizing them. For manual setup, choose the manual option and open the record instructions for the selected provider.

### 4. Publish both account-generated CNAME records

Mailchimp's manual workflow displays two CNAME owner and target pairs. Publish both without changing or combining them.

![Mailchimp manual authentication instructions showing the two DKIM CNAME rows, with the example domain redacted.](/images/editorial/how-do-i-set-up-spf-and-dkim-for-mailchimp/mailchimp-manual-cname-records.png)

*Source: [Mailchimp, "Set Up Email Domain Authentication"](https://mailchimp.com/help/set-up-email-domain-authentication/). Publication rights review is still required. [Open the full-size screenshot](/images/editorial/how-do-i-set-up-spf-and-dkim-for-mailchimp/mailchimp-manual-cname-records.png).*

**First DKIM CNAME**

- Record type: `CNAME`
- Host: the first account-generated Name or Host value
- Target: the matching account-generated Value or Points To value

**Second DKIM CNAME**

- Record type: `CNAME`
- Host: the second account-generated Name or Host value
- Target: the matching account-generated Value or Points To value

Do not copy a selector or target from another Mailchimp account. If the DNS provider appends the root domain, enter only the relative owner when required so the domain does not appear twice.

### 5. Preserve or add the DMARC TXT record deliberately

Mailchimp's manual workflow also shows a DMARC step at `_dmarc`. If a valid policy already exists, do not create a second DMARC record. Compare the current policy with the requirement shown by Mailchimp and preserve reporting addresses, alignment modes, subdomain policy, and enforcement settings unless the domain owner approves a change.

![Mailchimp manual authentication instructions showing the DMARC TXT record step.](/images/editorial/how-do-i-set-up-spf-and-dkim-for-mailchimp/mailchimp-manual-dmarc-txt.png)

*Source: [Mailchimp, "Set Up Email Domain Authentication"](https://mailchimp.com/help/set-up-email-domain-authentication/). Publication rights review is still required. [Open the full-size screenshot](/images/editorial/how-do-i-set-up-spf-and-dkim-for-mailchimp/mailchimp-manual-dmarc-txt.png).*

If the domain has no DMARC policy, start with a monitored rollout that accounts for every legitimate sender. Do not move directly to enforcement based only on one Mailchimp configuration.

### 6. Wait for Mailchimp validation and send a test campaign

Mailchimp begins validating the records after setup. The `Domains` page can show `Authentication in progress`, then `Authenticated` when the checks succeed. Once authenticated, send a new campaign through the production audience, From address, and account path to a mailbox where you can inspect raw headers.

## How does this setup affect DMARC?

Mailchimp's current manual setup focuses on two DKIM CNAME records and the domain's DMARC TXT record. Do not infer a separate root SPF edit from a generic SPF/DKIM article title. Follow the exact record set displayed by the selected Mailchimp account and validate what the delivered message used.

Under the [current DMARC standard](https://www.rfc-editor.org/info/rfc9989), a message passes when at least one authenticated SPF or DKIM identifier passes and aligns with the visible From domain. A valid Mailchimp DKIM signature can provide that aligned path. The delivered message, not the DNS setup screen alone, shows the result.

Use Palisade's [DMARC checker](/tools/dmarc) to inspect the published policy before changing enforcement.

## How do I validate the setup?

### Check public DNS

Resolve both account-generated CNAME owners and the root-domain DMARC TXT owner. Compare the complete CNAME targets with Mailchimp's current instructions. If a record resolves at a name containing the domain twice, correct the host field before restarting authentication.

Use Palisade to [check the DKIM selector](/tools/dkim). Public DNS checks do not prove that Mailchimp signed a production campaign or that its identifiers aligned with the From domain.

### Check the Mailchimp status

Return to `Account & billing > Domains`. The domain should show `Authenticated`. Mailchimp may show `Authentication in progress` while DNS updates. A failure state can offer `Resolve` or `Restart authentication`.

The status proves Mailchimp found the expected records. It does not prove that a later campaign used the intended From domain or passed DMARC at every receiver.

### Inspect a delivered message

Send a new campaign to an external mailbox and inspect the receiver-added `Authentication-Results` field. [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601) defines the field and its trust boundary. Confirm `dkim=pass`, record the DKIM `d=` domain, and compare it with the visible From domain.

Also record SPF and DMARC results. Mailchimp's guided setup may not require a root SPF edit, but the delivered header shows the actual MAIL FROM identity and whether SPF contributed to DMARC for that message.

### Review DMARC reports

Review aggregate reports after routine Mailchimp campaigns appear. Confirm the DKIM signing domain, SPF identity, alignment, volume, and disposition. Compare regular campaigns, automations, and any transactional path separately because one test message may not represent every Mailchimp workflow.

## Troubleshooting

### Mailchimp shows a CNAME owner with the domain repeated

The DNS provider likely appended the zone name to a full owner. Mailchimp documents this behavior as a common CNAME problem. Enter only the portion the provider expects, resolve the public owner, and confirm that the repeated suffix is gone.

### Authentication remains in progress

Mailchimp says most records update within minutes but validation can take up to 48 hours. Check the authoritative and public CNAME answers before changing correct records. If they match Mailchimp and the status remains pending, use the account's resolve or support path.

### The domain was authenticated before its CNAME records changed

Mailchimp stores the authentication state. Its documentation recommends disabling authentication and authenticating again after deliberate CNAME changes. Confirm the current records before restarting so a stale target is not republished.

### The DNS provider reports a CNAME conflict

Check the exact owner for another record. A CNAME cannot share its owner with unrelated TXT, MX, or other data. Do not delete the existing record until you identify which service uses it. Choose a safe migration or contact the DNS owner.

### Mailchimp is authenticated but DMARC still fails

Inspect the delivered DKIM `d=` domain, SPF MAIL FROM domain, and visible From domain. The campaign may use a different From domain, another Mailchimp account, or a separate transactional path. Fix the actual path rather than weakening the DMARC policy to hide the failure.

## Check the domain beyond Mailchimp

Run Palisade's [Email Security Score](/tools/email-security-score) after Mailchimp shows `Authenticated`. The score checks the wider public authentication posture, but it does not prove that a delivered campaign used the intended DKIM identity, provide continuous monitoring, or guarantee future delivery.

Mailchimp authentication covers one sending platform. Palisade's DMARC Agent turns aggregate-report data into a prioritized list of sender, SPF, DKIM, and DMARC issues. It detects when authentication and alignment conditions indicate that a domain is ready for the next policy stage, then proposes the move for your team to review and apply. This human-in-the-loop workflow helps you progress toward `p=reject` while keeping policy changes under your control. Stronger authentication helps protect your domains and supports better email deliverability.

Palisade does not change Mailchimp settings, control recipient decisions, guarantee inbox placement, or apply a DMARC policy change without human approval.

[Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=how-do-i-set-up-spf-and-dkim-for-mailchimp)

## Frequently asked questions

### Do I need to verify the domain before authenticating it?

Yes. Mailchimp requires verification before authentication. Verification confirms that you can access an address on the domain. Authentication then publishes DNS records that support signed and aligned campaign mail.

### Should I create a separate Mailchimp SPF record at the root domain?

No, not based on Mailchimp's current documented manual workflow. It shows two CNAME records and one DMARC TXT step. Publish only the records displayed by your account and preserve the domain's single SPF policy.

### Can I use Entri instead of editing DNS manually?

Yes. Mailchimp recommends Entri for automatic authentication when the DNS provider is supported. You still need authorization to approve the changes and should verify the resulting public records and a delivered campaign.

### Can I authenticate a Gmail or Yahoo address?

No. Mailchimp authentication requires a domain that you or your business owns and controls. Public mailbox domains cannot be authenticated because you cannot publish their DNS records.

### Does the Authenticated label prove DMARC passes?

No. The label confirms that Mailchimp validated its expected records. A production campaign still needs an aligned SPF or DKIM pass. Confirm the result in receiver-added headers and DMARC reports.

### Will Mailchimp authentication guarantee campaign delivery?

No. Authentication supports sender identity and DMARC alignment, but mailbox providers still evaluate reputation, content, complaints, engagement, and other signals. Treat authentication as required technical groundwork, not an inbox guarantee.