Mailchimp: DKIM and DMARC setup
How to authenticate your sending domain in Mailchimp — verify the domain, add the two DKIM CNAME records and the DMARC TXT record, and confirm the Authenticated status — with each step linked to Mailchimp's current help center.
This guide follows Mailchimp's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Mailchimp's current help page win.
For the protocols themselves, see SPF and DMARC.
Before you start
- You need access to your domain's DNS settings, usually at your registrar or hosting provider.
- Send from an address on a domain you own. Mailchimp's help says: "if you use a free email service like Gmail or Yahoo for your From email address, we strongly recommend you switch to an email address from a private domain" (About Email Domain Authentication).
What Mailchimp asks you to publish
| Purpose | Record type | Count | Where the values come from |
|---|---|---|---|
| DKIM | CNAME |
2 | Shown in Mailchimp as CNAME 1 and CNAME 2 |
| DMARC | TXT |
1 | Host _dmarc; value shown in Mailchimp |
Mailchimp: "your domain's DNS records need to be updated with 2 CNAME records (for DKIM) and 1 TXT record (for DMARC)" (About Email Domain Authentication).
Step 1 — Verify the domain
Verification confirms you have access to the domain. It comes before authentication: "Before you authenticate your email domain, you need to verify it." (Set Up Email Domain Authentication)
- Click your profile icon and choose Account & billing, then Domains.
- In the Email Domains section, click Add & Verify Domain.
- Enter an email address at the domain and click Send Verification Email.
- In that email, click Verify Domain Access, or enter the verification code in your account and click Verify.
Source: Verify an Email Domain.
Step 2 — Start authentication
- Click your profile icon and choose Account & billing, then the Domains tab.
- Click Start authentication next to the verified domain.
- Choose a method: Continue starts automatic authentication with Entri: Entri analyzes your domain, may detect your DNS provider, and prompts you to log in to your DNS provider. Or manually authenticate your domain shows the records to add yourself. For the manual path, select your DNS provider (or Other) and click Next.
Source: Set Up Email Domain Authentication.
Step 3 — Add the DKIM records
At your DNS provider, create the two CNAME records Mailchimp shows. Copy the Name (Host) and Value for CNAME 1 and CNAME 2 exactly as shown, then go back to Mailchimp and click Next.
If your DNS provider appends the domain automatically, enter only the host part (for example k2._domainkey, not k2._domainkey.example.com), or the record ends up as k2._domainkey.example.com.example.com.
Source: Set Up Email Domain Authentication.
Step 4 — Add the DMARC record
Create one TXT record with the Host _dmarc and the Value Mailchimp shows, then go back to Mailchimp and click Next.
If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing (RFC 7489 §6.6.3). See DMARC before changing an existing policy.
Source: Set Up Email Domain Authentication.
Step 5 — Wait for validation and check the status
Mailchimp validates the records. "Most records update within a few minutes, but this could take up to 48 hours." You receive an email when validation is complete. While it runs, the Domains page shows Authentication in progress; when it succeeds, the Authenticated label appears next to the domain. If it fails, the Domains page offers Resolve or Restart authentication.
Source: Set Up Email Domain Authentication.
Step 6 — Keep the records in place
Do not edit the DKIM CNAME records after authentication. Mailchimp stores the authentication; to change the records, disable authentication on the Domains page first, then re-authenticate once the DNS change is done.
Source: Set Up Email Domain Authentication.
SPF
Mailchimp's current help pages on domain authentication list the DKIM and DMARC records only. They do not document an SPF record step, so this guide does not give one.
How alignment works here
DMARC passes when a message passes DKIM or SPF and the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See DMARC for how alignment is evaluated.
Check your setup
Once Mailchimp shows Authenticated, run the free domain health check on your domain to see what receivers find in DNS for SPF, DKIM and DMARC.
The check looks for DKIM under a fixed list of common selectors, so it may not find your Mailchimp DKIM record on its own. Give it your selector through the check's API: https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=<selector>. The selector is the part of the DKIM record name before ._domainkey. For Mailchimp, it is the host of the DKIM CNAME records Mailchimp shows; Mailchimp's help uses k2 as its example (k2._domainkey).