Mailchimp: DKIM and SPF setup

Before you start

Mailchimp authenticates only a domain it has already verified. Verifying proves you may send from example.com, and you do it with a link or a code Mailchimp emails to an address at example.com. Mailchimp's page on authentication does not name a plan that it needs.

Authentication adds DNS records to example.com, so you also need access to its DNS settings.

Turn on DKIM

Mailchimp calls this domain authentication. It asks for two CNAME records for DKIM and one TXT record for DMARC.

1. Click your profile icon and choose Account & billing. If you are an account Manager, click Account.
2. Click the Domains tab.
3. Click Start authentication next to example.com.
4. Choose your DNS host in Select your DNS provider and click Next.
5. Mailchimp offers automatic setup through a service called Entri, which signs in to your DNS host for you. To add the records yourself, click Or manually authenticate your domain.
6. For manual setup, copy the Name and Value of CNAME 1 and CNAME 2 into your DNS host. Mailchimp's example name is k2._domainkey. If your DNS host adds example.com to every name, enter only that part.
7. Click Next, then deal with the DMARC step as described below, and click Next again.

About the DMARC step. A domain may have only one DMARC record. If example.com already has a DMARC record, it sends reports to your reporting address. Do not add a second record. If the value Mailchimp shows differs from yours, keep your own, because it holds your policy and reporting address.

While Mailchimp checks the records, the domain shows Authentication in progress. Mailchimp says most records update within minutes and some take up to 48 hours. It emails you when it is done.

Sign with your own domain

Reports show Mailchimp mail signed by one of Mailchimp's domains, such as mcsv.net. DKIM passes for that domain but does not align with example.com. Authenticate example.com as in Turn on DKIM. The DKIM records then sit under example.com, and DKIM can align.

Use your own bounce domain

The Mailchimp help pages this guide is written from describe no setting for a custom bounce domain. Mailchimp says the envelope sender usually contains mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net. SPF therefore does not align for Mailchimp mail.

DMARC needs only one of SPF and DKIM to align. Authenticate example.com as in Turn on DKIM, and Mailchimp mail passes DMARC through DKIM.

SPF

Mailchimp's authentication steps ask for no SPF record. Receiving servers check SPF against the envelope sender, and for Mailchimp mail that is one of Mailchimp's own domains. An SPF include in the record of example.com does not make Mailchimp mail align.

Check it worked

1. On the Domains tab, example.com shows Authenticated. If it failed, Mailchimp offers Resolve or Restart authentication.
2. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Mailchimp. The DKIM table on Mailmoni's DNS tab lists Mailchimp's selectors once a report includes them.

If you change the CNAME records after authenticating, Mailchimp asks you to disable authentication first and authenticate again afterwards.

Mailchimp's pages: Set up email domain authentication, About email domain authentication and My From name shows mcsv.net.