Set up SPF, DKIM and DMARC for Mailchimp

Records at a glance

Set up SPF for Mailchimp (you probably don’t need to)

Mailchimp’s domain authentication asks for two CNAMEs and a DMARC record, and no SPF change. Campaigns go out with a Mailchimp-owned envelope sender (the Return-Path), typically on domains such as mcsv.net or mcdlv.net. Receivers check SPF against that domain, and Mailchimp maintains its SPF record.

So the old include:servers.mcsv.net does nothing for campaign mail. If your SPF record still has it, you can remove it and get a DNS lookup back:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
v=spf1 include:_spf.google.com ~all

Keeping your root SPF record short matters once you use several services (see the 10-lookup limit). With DMARC Dojo’s hosted SPF you add or remove senders in the dashboard instead of editing DNS.

Set up DKIM (domain authentication)

1. Verify the domain first. Mailchimp sends a link or code to an address at that domain, and you can’t authenticate a domain you haven’t verified.
2. Click your profile icon and go to Account & billing, then the Domains tab. Next to the domain, choose Start authentication.
3. Mailchimp may offer to set records up automatically for supported DNS hosts. Otherwise, copy the two CNAME records and the TXT record it shows.
4. At your DNS host, create CNAME records at k2._domainkey and k3._domainkey and, if you don’t already have one, the DMARC TXT record at _dmarc.
5. Return to Mailchimp and let it validate the records. Mailchimp says most records update within minutes but it can take up to 48 hours.

Mailchimp hosts the keys behind the CNAMEs; as of September 2026 they are 2048-bit keys. To confirm signing, send a test campaign to yourself and look for dkim=pass with header.d= your domain. Until the domain is authenticated, recipients may see “via mcsv.net” or a similar Mailchimp domain next to your From name.

Make it pass DMARC (alignment)

• SPF never aligns for Mailchimp campaigns, because the Return-Path is a Mailchimp domain. That’s normal and not something to fix.
• DKIM aligns once you authenticate the domain. Mailchimp then signs with d= your domain, which matches the From address.

That makes DKIM the only path to a DMARC pass, so authenticate every domain you use as a From address. Don’t send campaigns from a free address such as Gmail or Yahoo: you can’t authenticate those domains, so the mail can’t align, and Yahoo publishes p=reject. DMARC alignment explains the rules.

Add a DMARC record

Mailchimp requires a DMARC record on authenticated domains, and Gmail and Yahoo require one from bulk senders. The minimum is v=DMARC1; p=none. Add a report address so you can see results:

v=DMARC1; p=none; rua=mailto:<your report address>

DMARC Dojo recognizes Mailchimp in DMARC reports, so you can check that campaign traffic passes DKIM with alignment before you move to quarantine and reject. Expect Mailchimp rows to show SPF “fail” for your domain; the DKIM result is the one that counts.

Troubleshooting

• Authentication won’t validate. The DNS host appended your domain, creating k2._domainkey.example.com.example.com. Enter just k2._domainkey.
• DKIM fails through Cloudflare. Set both CNAMEs to DNS only so they resolve to Mailchimp’s keys.
• Mailchimp says a DMARC record is missing. The record is at the wrong name, or there are two DMARC records, which invalidates both. Keep exactly one at _dmarc.
• Mail still shows “via mcsv.net”. The campaign’s From address uses a domain you haven’t authenticated, such as a different brand domain or a subdomain. Authenticate that domain too.