emailsecops
Menu
Guides

Mailchimp SPF, DKIM and DMARC setup

Authenticate the domain under Account & billing > Domains: two DKIM CNAMEs (k2 and k3) and a DMARC record, with the exact values shown on that page. No SPF change is needed. DKIM aligns with your From domain; SPF stays on Mailchimp's own domains.

Marketing email platform · reviewed October 13, 2026 against Mailchimp's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Mailchimp account: copy it from Mailchimp's setup screen, which shows the exact record.

ForTypeHostValue
DKIM CNAME k2._domainkey.{domain} dkim2.mcsv.netCNAME 1 on the Domains page; copy the exact Name and Value from there.
DKIM CNAME k3._domainkey.{domain} dkim3.mcsv.netCNAME 2 on the Domains page.
DMARC TXT _dmarc.{domain} {value shown in Mailchimp}Part of Mailchimp's authentication; copy the value from the Domains page and keep a single DMARC record.

SPF

No SPF change is needed: Mailchimp says SPF is already set up on its sending domains. The Return-Path sits on Mailchimp's own domains (mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net), so SPF can't align with your From domain and DMARC passes on DKIM instead.

DKIM

Two CNAMEs, k2._domainkey to dkim2.mcsv.net and k3._domainkey to dkim3.mcsv.net, point to keys Mailchimp hosts; the Domains page shows the exact Name and Value, or Entri adds them through your DNS provider. Don't change them after authenticating: disable authentication first, change DNS, then authenticate again.

DMARC alignment

DKIM only: once the two CNAMEs are authenticated, Mailchimp signs as your domain, which aligns with your From address. SPF stays on Mailchimp's envelope domains (mcsv.net and others) and never aligns.

Common mistakes

  • The setup used until July 2020 had a k1._domainkey CNAME to dkim.mcsv.net and an include:servers.mcsv.net in SPF; today's k2 and k3 CNAMEs replace the k1 record, and the SPF include can be removed.
  • Free-mail From addresses (Gmail, Yahoo and the like) can't be authenticated, and Mailchimp rewrites them to send.mailchimpapp.com or mail.mailchimpapp.com.
  • DNS hosts that append the domain need just k2._domainkey, or the record becomes k2._domainkey.example.com.example.com.
  • Verifying the domain (by email link or code) is separate from authenticating it, and subdomains are verified separately.
  • Gmail and Yahoo require custom authentication plus a published DMARC record from senders of more than 5,000 emails a day to their addresses.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Mailchimp

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: servers.mcsv.net
  • Default DKIM selectors: k2, k3
  • DKIM keys delegated (CNAME) to *.mcsv.net

Questions

What SPF record does Mailchimp need?+
No SPF change is needed: Mailchimp says SPF is already set up on its sending domains. The Return-Path sits on Mailchimp's own domains (mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net), so SPF can't align with your From domain and DMARC passes on DKIM instead.
What are the DKIM records for Mailchimp?+
Two CNAMEs, k2._domainkey to dkim2.mcsv.net and k3._domainkey to dkim3.mcsv.net, point to keys Mailchimp hosts; the Domains page shows the exact Name and Value, or Entri adds them through your DNS provider. Don't change them after authenticating: disable authentication first, change DNS, then authenticate again.
Does Mailchimp mail pass DMARC?+
DKIM only: once the two CNAMEs are authenticated, Mailchimp signs as your domain, which aligns with your From address. SPF stays on Mailchimp's envelope domains (mcsv.net and others) and never aligns.
Do I need a separate DMARC record for Mailchimp?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources