Setup guide

Mailchimp: SPF, DKIM and DMARC

Mailchimp sends from its own return-path, so SPF doesn't align with your domain. DMARC passes through DKIM, which needs two CNAME records.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Mailchimp documentation on October 13, 2026

DNS records to add

CNAMEHostk2._domainkey

dkim2.mcsv.net

DKIM key 1

CNAMEHostk3._domainkey

dkim3.mcsv.net

DKIM key 2

TXTHost_dmarc

v=DMARC1; p=none; rua=mailto:<your report address>

Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.

DMARC policy (part of Mailchimp's domain authentication)

Steps

In Mailchimp open Website → Domains, choose your domain and click Start authentication.
Publish the two CNAME records Mailchimp shows (k2 and k3 under _domainkey).
Publish a DMARC record if you don't have one, then click Authenticate Domain in Mailchimp.

Common mistakes

Verifying your domain in Mailchimp with the emailed code or link is not authentication. Verification alone doesn't affect delivery, so the DKIM and DMARC records are still needed.
Some DNS hosts append your domain to the Name field and create k2._domainkey.example.com.example.com. Enter only k2._domainkey and k3._domainkey so the CNAMEs land at the right name.
Until the domain is authenticated, recipients can see Mailchimp sending domains such as mcsv.net or mailchimpapp.net beside your From name as "via" or "on behalf of".
Sending from a Gmail or Yahoo address makes Mailchimp rewrite the From address onto send.mailchimpapp.com or mail.mailchimpapp.com, because free email domains can't be authenticated.

Good to know

You don't need to add Mailchimp to your SPF record.
If your DNS host is Cloudflare, set both CNAMEs to DNS only (grey cloud).

Frequently asked questions

What if Mailchimp can't authenticate my domain right after I add the records?

Wait and retry. Mailchimp says most records update within a few minutes, but it can take up to 48 hours for servers to recognize the change.

Does Mailchimp domain authentication include a DMARC record?

Yes. Mailchimp says a properly authenticated domain needs two DKIM CNAME records and one DMARC TXT record. Gmail and Yahoo separately require a published DMARC record from anyone sending more than 5,000 emails to their addresses in 24 hours.

Do I need to verify a subdomain separately in Mailchimp?

Yes. Verification is done once per domain, but a subdomain you send from needs its own verification.

How long is Mailchimp's domain verification code valid?

Verification links and codes expire after seven days. Request a new one if yours has expired.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Mailchimp documentation.

Check your Mailchimp setup

Or open the SPF checker, DKIM checker or DMARC checker directly.