SPF and DKIM for Mailchimp: Domain Authentication Setup Guide

Mailchimp's domain authentication is one of the simpler setups in this series — it's built primarily around two DKIM CNAME records rather than requiring a separate SPF include for most modern setups. This guide covers exactly what Mailchimp asks you to publish and what each record actually does.

If you're combining Mailchimp with a primary mail platform like Microsoft 365 or Google Workspace, see those specific guides — SPF and DKIM for Microsoft 365 or SPF and DKIM for Google Workspace — since your SPF record will need to account for both.

What you will learn:

The two CNAME records Mailchimp's domain authentication requires
How Mailchimp handles SPF differently from most platforms
Where DMARC fits into Mailchimp's own setup flow
Common mistakes specific to Mailchimp setups

Starting domain authentication in Mailchimp

In your Mailchimp account, go to Domains (under account settings) and choose Authenticate Domain for the sending domain you want to verify. Mailchimp generates two CNAME records unique to your account.

Three-step flow showing Mailchimp domain authentication: start authentication in Mailchimp account settings, publish the two generated DKIM CNAME records, then confirm verified status in the dashboard

The two DKIM CNAME records

Mailchimp's domain authentication is centered on publishing two CNAME records that handle DKIM signing. The exact values are account-specific, but they follow a selector-based pattern similar to k1._domainkey and k2._domainkey:

Host:  k1._domainkey.example.com
Type:  CNAME
Value: dkim1.mcsv.net

Host:  k2._domainkey.example.com
Type:  CNAME
Value: dkim2.mcsv.net

Use the exact host and value pairs Mailchimp displays in your own account's setup screen rather than these illustrative examples — the selector prefixes and target values are generated per account and won't be identical across different Mailchimp customers. As with any CNAME-based setup, enter only the host portion (k1._domainkey, not the full k1._domainkey.example.com) at DNS providers that automatically append the domain.

Annotated example of the two DKIM CNAME records Mailchimp domain authentication requires, pointing k1 and k2 domainkey hosts to Mailchimp-managed mcsv.net targets

SPF considerations with Mailchimp

Mailchimp's domain authentication flow, as of current documentation, centers on the two DKIM CNAMEs above and does not require a separate SPF include as part of that specific flow. If you're using Mailchimp's older or alternative sending configurations, you may still encounter a requirement to add:

include:servers.mcsv.net

to your domain's SPF record. Check what Mailchimp's own setup screen displays for your account — if it only asks for the two CNAME records above, a separate SPF include generally isn't required for DKIM-based alignment to work, since DMARC only needs one of SPF or DKIM to pass and align. See Alignment vs Authentication for why that matters here specifically — DKIM alignment alone is sufficient for DMARC to pass, even without a matching SPF include.

If you do add the SPF include, combine it with your other sending platforms — Microsoft 365, Google Workspace, and so on — in a single record:

example.com TXT "v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all"

The DMARC TXT record Mailchimp may prompt for

Mailchimp's authentication setup can also surface a prompt related to a DMARC record at _dmarc.example.com. If you don't already have DMARC configured on your domain, this is a good moment to set one up — but treat it as your organization's DMARC record, not something owned by Mailchimp specifically. Follow What is DMARC? for a proper rollout starting at p=none, rather than accepting a default value from any single platform's setup wizard, since your DMARC policy needs to account for every sending platform on the domain, not just Mailchimp.

Verifying your setup

Check the DKIM CNAMEs

dig CNAME k1._domainkey.example.com +short
dig CNAME k2._domainkey.example.com +short

Both should resolve to the mcsv.net targets Mailchimp displayed during setup.

Confirm in Mailchimp's dashboard

The Domains page shows an authentication status per domain — it should show as verified once both CNAME records have propagated and Mailchimp's own check succeeds.

Send a real test campaign

Send a test campaign to a mailbox where you can inspect full headers. Confirm dkim=pass appears in Authentication-Results, and that the d= value matches your domain rather than mcsv.net — that's the alignment check that determines whether DMARC will actually pass for Mailchimp-sent mail. See Every DKIM Attribute Explained for exactly where to find the d= tag in a signature header.

Common mistakes with Mailchimp

Assuming SPF is required when it isn't part of your specific flow. Check what your account's setup screen actually asks for rather than assuming based on older guides — Mailchimp's exact requirements can differ depending on account type and setup path.

Publishing CNAME records at the wrong host. As with any CNAME-based DKIM setup, whether to include the domain suffix depends on your DNS provider's convention.

Sending from a domain that was never authenticated. If your Mailchimp account sends "from" a domain other than the one you ran authentication for, DKIM alignment fails regardless of how correctly the CNAME records are configured — the signing domain won't match your visible From address.

Treating Mailchimp's DMARC prompt as a complete DMARC setup. A DMARC record needs to account for every platform sending mail as your domain, not just Mailchimp — publish it based on your full sending inventory, not a single platform's suggestion.

Frequently asked questions

Does Mailchimp require an SPF record?

Not necessarily, for the current domain authentication flow, since DKIM alignment alone can satisfy DMARC. Check your own account's setup screen — if it only requests the two DKIM CNAMEs, no separate SPF include is required for that flow specifically.

What if I use Mailchimp alongside my main business email platform?

Your SPF record only needs a Mailchimp include if Mailchimp's specific flow requires it (see above). Regardless, your DKIM setup is independent per platform — Mailchimp's CNAMEs coexist with your main platform's DKIM selector without conflict, since DKIM doesn't require consolidation into one record. See the Microsoft 365 or Google Workspace guides if that's your primary platform.

Why did Mailchimp's authentication check fail right after I added the records?

Most likely DNS propagation delay. Wait 15–30 minutes and retry — this is normal and not usually a sign of a misconfigured record.

Should I let Mailchimp's setup flow create my DMARC record?

Treat it as a starting point at most, not a finished configuration. Your DMARC record should reflect every sending platform on your domain, not just Mailchimp — see What is DMARC? for a proper rollout.

Next steps

Once Mailchimp shows verified authentication, check your domain's complete authentication status with grimDMARC's free Domain Scanner. If you're managing several marketing and transactional platforms across many customer domains, Hosted SPF consolidates the ongoing maintenance of combining multiple platforms into one record.

About this guide

This guide was written by the team building grimDMARC — a managed DMARC and SPF platform for MSPs and their customers. If you have questions about Mailchimp authentication or feedback on this guide, reach us at hello@grimdmarc.com.

Last updated: August 2026 Reading time: 7 minutes Reviewed by: grimDMARC team