Mailchimp: set up SPF, DKIM and DMARC

To authenticate a domain for Mailchimp campaigns, add the two DKIM CNAME records Mailchimp gives you during domain authentication — k2._domainkey pointing to dkim2.mcsv.net and k3._domainkey pointing to dkim3.mcsv.net — and publish a DMARC record at _dmarc. Mailchimp sends from its own infrastructure, so the DKIM CNAMEs (which let Mailchimp sign with your domain) are what earn DMARC alignment; you generally do not add a Mailchimp include to your SPF record. Always copy the exact records shown in your Mailchimp account, since some values are account-specific.

Why Mailchimp is different from an inbox provider

With Google Workspace or Microsoft 365 you send as your domain, so SPF authenticates your domain directly. Mailchimp is a bulk-sending platform: the envelope return-path is a Mailchimp domain, so SPF authenticates Mailchimp, not you. DMARC needs at least one of SPF or DKIM to align with your From-address domain — and here that alignment comes from DKIM. The DKIM CNAMEs are the records that matter; include:servers.mcsv.net in your own SPF adds nothing to alignment.

Step 1 — DKIM (the CNAMEs that matter)

In Mailchimp, go to your account and start domain authentication for the sending domain (the domain in your campaigns' From address). The current flow issues two CNAME records:

Host:  k2._domainkey.yourdomain.com
Value: dkim2.mcsv.net

Host:  k3._domainkey.yourdomain.com
Value: dkim3.mcsv.net

Some older accounts still show the legacy single record (k1._domainkey → dkim.mcsv.net). Either way, copy the hosts and values exactly as Mailchimp shows them in your account. Add them as CNAME records in your DNS, then click Authenticate back in Mailchimp so it can verify.

Mailchimp's official instructions: Set up email domain authentication.

Step 2 — SPF (leave your own record clean)

You do not need a Mailchimp entry in your domain's SPF record for campaigns to authenticate — alignment is handled by the DKIM CNAME above. Keep your existing SPF record for the services that send as your domain (your inbox provider, your helpdesk), and keep it within the 10-lookup limit. Check it with the SPF lookup counter.

Step 3 — DMARC

Mailchimp's authentication wizard also hands you a _dmarc TXT record as part of the same flow. A domain needs exactly one DMARC record — use the wizard's or the one below, not both. If you want aggregate reports sent to your own address, publish this one:

Start at p=none and watch the aggregate reports. Because Mailchimp mail aligns via DKIM, it should show as passing once the CNAME is authenticated — confirm that before you tighten to p=quarantine or p=reject, so a policy change never silently drops your campaigns. Validate the record in the DMARC record checker.

Where to add these records

The DKIM records are CNAMEs; the DMARC record is TXT. All go in your domain's DNS zone at your registrar or DNS host:

• Enter only the host prefixes Mailchimp shows (k2._domainkey, k3._domainkey) — most panels append your domain.
• A CNAME's value must be a bare hostname (dkim2.mcsv.net) with no http:// and no trailing slash.

DNS changes can take a few hours to propagate before Mailchimp can authenticate the domain.

Verify it worked

Mailchimp marks the domain authenticated once the CNAMEs resolve. Send yourself a test campaign, open the raw headers, and confirm dkim=pass with d=yourdomain.com and dmarc=pass. To see DKIM presence and DMARC alignment in one place, run a scan of your domain below.