--- title: "Mailchimp DMARC setup" description: "Mailchimp DMARC setup: verify your domain, publish Mailchimp-generated DKIM and DMARC DNS records, validate authentication, and inspect a test email." canonical: https://www.palisade.email/learning/mailchimp-dmarc-setup last-updated: 2026-11-09 --- # Mailchimp DMARC setup > Mailchimp DMARC setup: verify your domain, publish Mailchimp-generated DKIM and DMARC DNS records, validate authentication, and inspect a test email. Mailchimp DMARC setup starts in **profile icon > Account billing > Domains > Start authentication** beside a verified sending domain. Choose Entri for the supported automatic DNS flow or copy the two Mailchimp-generated DKIM CNAME records and its account-specific DMARC TXT record into DNS manually, then wait for Mailchimp validation and test a newly delivered campaign message. ## Quick takeaways - Mailchimp requires domain verification before you can authenticate a sending domain. - Mailchimp authentication applies only to domains your organization owns and controls. - Manual Mailchimp authentication uses two DKIM CNAME records and one DMARC TXT record. - The CNAME targets and DMARC TXT value are generated for the selected Mailchimp account and domain. - A successful Mailchimp status does not prove that a delivered campaign passed DKIM or DMARC. - Mailchimp says validation often completes in minutes but can take up to 48 hours. ## What should I check before configuring Mailchimp? Confirm that the domain in Mailchimp is the domain visible in the From address used for campaigns. Mailchimp's [email domain authentication instructions](https://mailchimp.com/help/set-up-email-domain-authentication/) state that you must verify a domain before authenticating it, and that public email services such as Gmail and Yahoo cannot be authenticated through this workflow. Confirm who controls the authoritative DNS zone and who can approve DNS changes. Also identify the sending path in scope. This workflow covers Mailchimp marketing email. Mailchimp Transactional users must authenticate their domain before sending transactional messages to external recipients, according to Mailchimp's [domain authentication documentation](https://mailchimp.com/help/set-up-email-domain-authentication/). If you need a wider overview of provider-specific sending-domain work, see the [vendor email authentication guide](/learning/esp-setup). Keep a test mailbox available where you can inspect the raw source of a message sent after authentication completes. > Copy DNS values from the account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example. For the SPF and DKIM record setup itself, see [how to set up SPF and DKIM for Mailchimp](/learning/how-do-i-set-up-spf-and-dkim-for-mailchimp); this page stays focused on DMARC. Do not change an existing SPF record because Mailchimp authentication displays DKIM and DMARC records. SPF has separate alignment rules and separate DNS constraints. The [Mailchimp SPF record guide](/learning/why-does-mailchimp-dmarc-alignment-not-require-adding-mailchimp-to-spf) explains why a Mailchimp campaign can satisfy DMARC through aligned DKIM without adding Mailchimp to SPF by assumption. ## Which setup method should I use? Use Entri if your DNS provider is supported and you are authorized to connect it through Mailchimp. Mailchimp recommends Entri for automatic authentication. When the connection succeeds, Mailchimp reports: `Records have been created for [your domain]`. Use manual authentication when your DNS provider is not available through Entri, when DNS changes require a separate approval process, or when your organization needs to review each record before publication. Manual setup requires you to copy the exact values Mailchimp displays for the selected domain. Mailchimp's documented account path is **profile icon > Account billing > Domains**, then **Start authentication** beside the verified domain. Account Managers may see **Account** instead of **Account billing**. Mailchimp also provides authentication prompts from its home checklist, delivery warnings, campaign From-field prompt, and Transactional checklist. ![Comparison of Entri automatic authentication and manual authentication in Mailchimp, showing when each applies](/images/editorial/mailchimp-dmarc-setup/mailchimp-dmarc-setup-entri-vs-manual.webp "1200x442") *Source: Palisade.* ## How do I configure SPF and DKIM for Mailchimp? This page covers the DMARC record. SPF and DKIM for Mailchimp have their own guide: [how to set up SPF and DKIM for Mailchimp](/learning/how-do-i-set-up-spf-and-dkim-for-mailchimp). The steps below show where the DMARC record fits in the same Mailchimp authentication flow. ### 1. Open the Domains settings In Mailchimp, select the profile icon, then open **Account billing > Domains**. If you use an Account Manager role, open **Account > Domains** instead. Find the verified custom domain that will appear in your campaign From addresses and select **Start authentication**. Check the selected domain before continuing. Mailchimp can contain multiple verified domains, and the DNS values belong to the domain selected in this workflow. ### 2. Choose Entri or manual authentication Choose Entri if you want Mailchimp to connect to the DNS provider and create the supported records through that connection. Review the DNS-provider authorization carefully before approving it. Choose manual authentication if you need to enter records in another DNS console. The manual flow displays the DKIM CNAME records and one DMARC TXT record. ### 3. Publish the Mailchimp-generated DMARC record The DKIM CNAME records are covered in [how to set up SPF and DKIM for Mailchimp](/learning/how-do-i-set-up-spf-and-dkim-for-mailchimp). Publish those as that page describes, then add the DMARC record here. Mailchimp displays a DMARC TXT record with the host `_dmarc` and an account-specific value field. **Record type:** `TXT` **Host:** ```text _dmarc ``` **Value:** ```text Copy the Mailchimp-generated value exactly. ``` > Do not publish placeholder values or values copied from another Mailchimp account. Generate and copy the real DMARC TXT value from the Mailchimp authentication flow for your selected domain. Some DNS providers automatically append the zone name to a host field. Entering a complete domain where the provider expects only a relative host can create a duplicated owner name. Confirm the final fully qualified record name before saving. Do not overwrite an existing DMARC TXT record without establishing what it does for the domain's other sending paths. A domain can have only one DMARC record at `_dmarc`. Mailchimp's documentation does not explain how to merge an existing DMARC record with the value it generates. Use a documented [DMARC setup guide](/dmarc-setup) before changing an existing policy. ### 4. Return to Mailchimp and wait for validation After publishing the records, return to Mailchimp and continue the authentication flow. Mailchimp validates the published records. Its documentation says most changes update within minutes, but validation can take up to 48 hours. During this period, the Domains page can show `Authentication in progress`. A campaign can also show a warning that the domain is still being authenticated. Do not repeatedly replace DNS records while validation is pending. First compare the public DNS answer with the exact account-generated values shown in Mailchimp. ### 5. Send a real test message After Mailchimp validates the domain, send a new campaign from the configured From domain to a mailbox where you can inspect raw headers. Do not use a message sent before the records were published. Look for the `DKIM-Signature` header and the receiver-added `Authentication-Results` header. A delivered-message test checks the actual campaign path, which is different from confirming that DNS records exist. ## How does this setup affect DMARC? Mailchimp's manual authentication flow includes a DMARC TXT record, but DMARC evaluation occurs on received messages. A DMARC result depends on the message's authentication results and whether the relevant authenticated domain aligns with the visible From domain. Use Palisade's [DMARC checker](/tools/dmarc) after publication to inspect the publicly visible DMARC record. A public lookup can show the current DNS answer, but it cannot prove that Mailchimp sent a particular campaign with the expected DKIM signature or that a receiver will make a particular delivery decision. ![Record checklist showing the Mailchimp-generated DKIM CNAME records and DMARC TXT record that need separate validation](/images/editorial/mailchimp-dmarc-setup/mailchimp-dmarc-setup-record-checklist.webp "1200x533") *Source: Palisade.* ## How do I validate the setup? ### Check public DNS Query the two exact CNAME owners and `_dmarc` through the authoritative DNS provider and a public resolver. Compare each answer to the values Mailchimp generated for this account and domain. ```bash dig +short CNAME . dig +short TXT _dmarc. ``` The DMARC checker is useful for inspecting the public record. It does not confirm Mailchimp account status or a production campaign result. ### Check the Mailchimp status Return to **Account billing > Domains** and review the authentication state for the selected domain. A completed Mailchimp status shows that Mailchimp accepted the DNS configuration it checked. A green status is not a delivered-message check. Test the actual Mailchimp sending path separately. ### Inspect a delivered message Open the raw source of a newly received campaign message. Confirm that the message contains the expected DKIM signature and inspect the receiving mailbox's `Authentication-Results` header. [Authentication-Results is defined by RFC 8601](https://datatracker.ietf.org/doc/html/rfc8601). The receiver that adds this field is the relevant trust boundary, so use results from the mailbox that received your test message. ### Review DMARC reports Once aggregate reports arrive, review Mailchimp traffic alongside every other source that sends with the domain. Palisade is agentic DMARC software that analyzes aggregate-report data, identifies sending sources and authentication or alignment issues, and creates prioritized remediation tickets. It can propose a next policy step when the evidence supports it, while a human reviews the evidence and applies any change. ## Troubleshooting ### Mailchimp does not show Start authentication Confirm that the sending domain is verified in Mailchimp. Mailchimp states that verification is required before authentication. Also confirm that the domain is a custom domain your organization owns and controls, not a public mailbox domain. ### Mailchimp still shows Authentication in progress Wait for the validation period Mailchimp documents, which can be up to 48 hours. Then compare the public DNS answers with every character of the two CNAME values and the DMARC TXT value shown in Mailchimp. Check for a duplicated domain suffix in the DNS host field, a mistyped CNAME target, or a TXT value that was truncated by the DNS interface. ### The DNS records exist but Mailchimp cannot validate them Query the fully qualified owner names from outside the DNS provider's dashboard. Confirm that each CNAME resolves to the target Mailchimp generated and that `_dmarc` returns the expected TXT value. If a DMARC record already existed, stop before replacing it. Mailchimp's documentation does not establish how to combine its generated value with an existing record. ### Mailchimp validates the domain but the test message fails DMARC Inspect the raw headers of a new campaign message. The Mailchimp status does not establish the receiver's message-level authentication result. Compare the visible From domain, DKIM signing domain, and receiver-added `Authentication-Results` data before changing DNS or SPF. ### A campaign still displays the 48-hour authentication warning Confirm that the campaign uses the same verified domain that you authenticated. The warning can persist while Mailchimp is validating the published records. If the public answers match the displayed values, allow the documented validation time before making another DNS change. ## Check the published DMARC record after Mailchimp setup Check the sending domain with Palisade's [DMARC checker](/tools/dmarc) after Mailchimp validates the records. Compare the published DMARC result with the domain and values selected in Mailchimp before changing anything else. A DMARC record check does not prove that Mailchimp signed a particular campaign, repair a DNS mistake, monitor future sender changes, or guarantee inbox placement. For the remaining operational gap, Palisade can analyze DMARC aggregate reports across your sending sources and surface authentication or alignment issues for human review. [Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=mailchimp-dmarc-setup) ## Sources and further reading - [Mailchimp: Set up email domain authentication](https://mailchimp.com/help/set-up-email-domain-authentication/) - [Google email sender guidelines](https://support.google.com/a/answer/81126) - [Yahoo sender best practices](https://senders.yahooinc.com/best-practices/) - [RFC 8601: Authentication-Results header field](https://datatracker.ietf.org/doc/html/rfc8601) - [Palisade DMARC checker](/tools/dmarc) - [ESP setup guides](/learning/esp-setup) ## Frequently asked questions ### Does Mailchimp require DMARC? Only for some senders. Mailchimp's [domain authentication guidance](https://mailchimp.com/help/set-up-email-domain-authentication/) ties custom authentication and a published DMARC record to Gmail and Yahoo's requirement for senders of more than 5,000 emails in 24 hours. Google's [email sender guidelines](https://support.google.com/a/answer/81126) set the threshold at more than 5,000 messages per day to Gmail accounts and allow a DMARC policy of `none`. [Yahoo's sender best practices](https://senders.yahooinc.com/best-practices/) require bulk senders to publish a DMARC policy of at least `p=none` that passes, and do not state a message-count threshold. ### How do I set up DMARC correctly in Mailchimp? Mailchimp-specific DMARC setup requires a verified custom domain, the Mailchimp authentication flow, and either Entri or manual DNS entry. For manual setup, publish the Mailchimp-generated DMARC TXT record with host `_dmarc`, then wait for Mailchimp validation and inspect a newly delivered campaign message. ### How do I set up DKIM for Mailchimp? DKIM for Mailchimp is set up through the domain authentication flow, which has its own guide: [how to set up SPF and DKIM for Mailchimp](/learning/how-do-i-set-up-spf-and-dkim-for-mailchimp). After the DKIM records validate, add the DMARC TXT record described above. ### How do I change the authentication method in Mailchimp? Mailchimp documents Entri and manual authentication methods, but its published documentation does not establish how to switch methods after authentication is already underway. Check the current Domains workflow in your Mailchimp account or contact Mailchimp support before abandoning an in-progress DNS change. ### Can I authenticate a Gmail or Yahoo address in Mailchimp? No. Mailchimp states that authentication can only be added to domains that you or your business own and control, and that public email services such as Gmail and Yahoo cannot be authenticated through this workflow.