# Mailchimp: DKIM and DMARC setup > How to authenticate your sending domain in Mailchimp — verify the domain, add the two DKIM CNAME records and the DMARC TXT record, and confirm the Authenticated status — with each step linked to Mailchimp's current help center. Source: emailmarketing.net — https://emailmarketing.net/learn/esp-guides/mailchimp This guide follows Mailchimp's own help center, checked on 2026-09-11. Each step links to the page it comes from. Menu names and record values can change: if the app shows something different, the app and Mailchimp's current help page win. For the protocols themselves, see [SPF](https://emailmarketing.net/learn/authentication/spf) and [DMARC](https://emailmarketing.net/learn/authentication/dmarc). ## Before you start - You need access to your domain's DNS settings, usually at your registrar or hosting provider. - Send from an address on a domain you own. Mailchimp's help says: "if you use a free email service like Gmail or Yahoo for your From email address, we strongly recommend you switch to an email address from a private domain" ([About Email Domain Authentication](https://mailchimp.com/help/about-email-authentication/)). ## What Mailchimp asks you to publish | Purpose | Record type | Count | Where the values come from | |---|---|---|---| | DKIM | `CNAME` | 2 | Shown in Mailchimp as CNAME 1 and CNAME 2 | | DMARC | `TXT` | 1 | Host `_dmarc`; value shown in Mailchimp | Mailchimp: "your domain's DNS records need to be updated with 2 CNAME records (for DKIM) and 1 TXT record (for DMARC)" ([About Email Domain Authentication](https://mailchimp.com/help/about-email-authentication/)). ## Step 1 — Verify the domain Verification confirms you have access to the domain. It comes before authentication: "Before you authenticate your email domain, you need to verify it." ([Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/)) 1. Click your profile icon and choose **Account & billing**, then **Domains**. 2. In the **Email Domains** section, click **Add & Verify Domain**. 3. Enter an email address at the domain and click **Send Verification Email**. 4. In that email, click **Verify Domain Access**, or enter the verification code in your account and click **Verify**. Source: [Verify an Email Domain](https://mailchimp.com/help/verify-a-domain/). ## Step 2 — Start authentication 1. Click your profile icon and choose **Account & billing**, then the **Domains** tab. 2. Click **Start authentication** next to the verified domain. 3. Choose a method: **Continue** starts automatic authentication with Entri: Entri analyzes your domain, may detect your DNS provider, and prompts you to log in to your DNS provider. **Or manually authenticate your domain** shows the records to add yourself. For the manual path, select your DNS provider (or **Other**) and click **Next**. Source: [Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/). ## Step 3 — Add the DKIM records At your DNS provider, create the two `CNAME` records Mailchimp shows. Copy the **Name (Host)** and **Value** for **CNAME 1** and **CNAME 2** exactly as shown, then go back to Mailchimp and click **Next**. If your DNS provider appends the domain automatically, enter only the host part (for example `k2._domainkey`, not `k2._domainkey.example.com`), or the record ends up as `k2._domainkey.example.com.example.com`. Source: [Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/). ## Step 4 — Add the DMARC record Create one `TXT` record with the **Host** `_dmarc` and the **Value** Mailchimp shows, then go back to Mailchimp and click **Next**. If your domain already has a DMARC record, do not add a second one: when a receiver finds more than one DMARC record, it applies no DMARC processing ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)). See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) before changing an existing policy. Source: [Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/). ## Step 5 — Wait for validation and check the status Mailchimp validates the records. "Most records update within a few minutes, but this could take up to 48 hours." You receive an email when validation is complete. While it runs, the Domains page shows **Authentication in progress**; when it succeeds, the **Authenticated** label appears next to the domain. If it fails, the Domains page offers **Resolve** or **Restart authentication**. Source: [Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/). ## Step 6 — Keep the records in place Do not edit the DKIM CNAME records after authentication. Mailchimp stores the authentication; to change the records, disable authentication on the Domains page first, then re-authenticate once the DNS change is done. Source: [Set Up Email Domain Authentication](https://mailchimp.com/help/set-up-email-domain-authentication/). ## SPF Mailchimp's current help pages on domain authentication list the DKIM and DMARC records only. They do not document an SPF record step, so this guide does not give one. ## How alignment works here DMARC passes when a message passes DKIM or SPF **and** the domain that passed is in alignment with the domain in the visible From address; one aligned pass is enough. Send from an address at the domain you authenticated. See [DMARC](https://emailmarketing.net/learn/authentication/dmarc) for how alignment is evaluated. ## Check your setup Once Mailchimp shows **Authenticated**, run the free [domain health check](https://emailmarketing.net/tools/domain-check) on your domain to see what receivers find in DNS for SPF, DKIM and DMARC. The check looks for DKIM under a fixed list of common selectors, so it may not find your Mailchimp DKIM record on its own. Give it your selector through the check's API: `https://emailmarketing.net/api/domain-check?domain=yourdomain.com&selector=`. The selector is the part of the DKIM record name before `._domainkey`. For Mailchimp, it is the host of the DKIM CNAME records Mailchimp shows; Mailchimp's help uses `k2` as its example (`k2._domainkey`).