emailsecops
Menu
Guides

Mailchimp Transactional (Mandrill) SPF, DKIM and DMARC setup

Since March 15, 2024 every Mandrill sending domain needs domain verification, two DKIM CNAMEs (mte1 and mte2) and a DMARC record. DKIM aligns with your From domain; SPF is not part of the current requirements.

Transactional email API · reviewed October 13, 2026 against Mailchimp Transactional (Mandrill)'s documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Mailchimp Transactional (Mandrill) account: copy it from Mailchimp Transactional (Mandrill)'s setup screen, which shows the exact record.

ForTypeHostValue
Domain verification optional TXT {domain} mandrill_verify.{verify_txt_key}Verification is required; this TXT or a link emailed to an address at the domain does it.
DKIM CNAME mte1._domainkey.{domain} dkim1.mandrillapp.comShown under Settings > Domains > View DKIM settings.
DKIM CNAME mte2._domainkey.{domain} dkim2.mandrillapp.com
Return path optional CNAME {subdomain}.{domain} mandrillapp.comCustom Return-Path on a subdomain such as mail.{domain}, added under Settings > Tracking & Return Path Domains.
DMARC TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Required since March 15, 2024; any policy satisfies it, and v=DMARC1; p=none is the minimum.

SPF

Not needed: Mailchimp's current requirements are domain verification, the two DKIM CNAMEs and DMARC. The default Return-Path is mandrillapp.com, so an SPF include on your domain wouldn't align with your From domain anyway.

DKIM

Two CNAMEs, mte1._domainkey to dkim1.mandrillapp.com and mte2._domainkey to dkim2.mandrillapp.com, shown under Settings > Domains > View DKIM settings. They replace the older single TXT key at mandrill._domainkey.

DMARC alignment

DKIM: with the mte1 and mte2 CNAMEs, Mandrill signs your mail as your domain, and DMARC passes on that. SPF doesn't align by default because the Return-Path is mandrillapp.com.

Common mistakes

  • Without the two DKIM CNAMEs and a DMARC record, Mandrill sends from a mandrillapp.com subdomain instead of your domain (replies still reach your address).
  • Mandrill rejects mail from unverified domains, or from domains without valid DKIM and DMARC, as unsigned.
  • The old single TXT key at mandrill._domainkey and include:spf.mandrillapp.com come from the previous setup; the mte1 and mte2 CNAMEs replace the TXT key, and the SPF include is no longer a requirement.
  • DNS hosts that append the domain can double _dmarc and the mte selectors, so check the full names after saving.
  • Return-path and tracking domains must be subdomains, and each can be added to one Transactional account only.
  • Mandrill's DKIM records differ from Mailchimp Marketing's: mte1 and mte2 point to mandrillapp.com, while Mailchimp's k2 and k3 point to mcsv.net.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Mailchimp Transactional (Mandrill)

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: spf.mandrillapp.com
  • Default DKIM selectors: mte1, mte2, mandrill
  • DKIM keys delegated (CNAME) to *.mandrillapp.com

Questions

What SPF record does Mailchimp Transactional (Mandrill) need?+
Not needed: Mailchimp's current requirements are domain verification, the two DKIM CNAMEs and DMARC. The default Return-Path is mandrillapp.com, so an SPF include on your domain wouldn't align with your From domain anyway.
What are the DKIM records for Mailchimp Transactional (Mandrill)?+
Two CNAMEs, mte1._domainkey to dkim1.mandrillapp.com and mte2._domainkey to dkim2.mandrillapp.com, shown under Settings > Domains > View DKIM settings. They replace the older single TXT key at mandrill._domainkey.
Does Mailchimp Transactional (Mandrill) mail pass DMARC?+
DKIM: with the mte1 and mte2 CNAMEs, Mandrill signs your mail as your domain, and DMARC passes on that. SPF doesn't align by default because the Return-Path is mandrillapp.com.
Do I need a separate DMARC record for Mailchimp Transactional (Mandrill)?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources