Learn · Email authentication

How to set up DMARC and DKIM for Mailchimp

Mailchimp sends your campaigns from its own servers, so by default the DKIM signature says d=mailchimp.com and the SPF check uses a Return-Path on mailchimp.com. Both checks pass — but for Mailchimp’s domain, not yours. DMARC requires one of them to match your From address. The fix is to authenticate your domain in Mailchimp by adding custom DKIM records (CNAMEs) to your DNS. Mailchimp doesn’t offer a custom Return-Path, so DKIM alignment is the only path to DMARC pass. This article walks through the steps and shows what changes in your reports.

Why Mailchimp campaigns fail DMARC out of the box

When you send a campaign from Mailchimp without any domain authentication, the email looks like this from an authentication perspective:

• From address: news@yourbrand.com
• SPF: passes because Mailchimp’s servers are authorized in Mailchimp’s own SPF record, but the Return-Path domain is mailchimp.com — not your domain.
• DKIM: passes because Mailchimp signs the message with its own private key, but the d= domain is mailchimp.com — not your domain.
• DMARC: fails because neither SPF nor DKIM is aligned (the passing domain doesn’t match yourbrand.com).

This is the classic “SPF pass, DKIM pass, DMARC fail” scenario that confuses many people starting out. Nothing is broken; you just haven’t told Mailchimp to sign as you.

Where to find the domain authentication settings in Mailchimp

Mailchimp keeps its domain settings under Website → Domains. From the main dashboard, click the Website tab, then Domains. You’ll see a list of domains you’ve already connected (e.g., for landing pages) and an option to “Authenticate a domain” or “Connect a domain”. The exact label may vary, but the page is always called Domains. Select the domain you want to use for sending campaigns — typically a subdomain like news.yourbrand.com — and follow the prompts to verify ownership and set up custom DKIM.

How to set up custom DKIM for Mailchimp

1. Start the authentication flow. In the Domains page, click “Authenticate domain” (or the equivalent button). Enter the domain you want to send from (e.g., news.yourbrand.com).
2. Verify domain ownership. Mailchimp will ask you to add a TXT record to your DNS — typically a verification string like mailchimp-verification=.... Add it to your DNS provider and wait for propagation (usually a few minutes).
3. Add the DKIM CNAME records. Once ownership is verified, Mailchimp will generate two or three CNAME records. They look something like this:

   k1._domainkey.news.yourbrand.com → dkim.mcsv.net
   k2._domainkey.news.yourbrand.com → dkim2.mcsv.net

   Add each CNAME to your DNS exactly as provided. These records tell receiving mail servers that Mailchimp is authorized to sign email for your domain.
4. Confirm activation. Back in Mailchimp, click “Verify” or “Activate”. Mailchimp will check that the CNAMEs resolve correctly. Once confirmed, your domain shows as “Authenticated” and all future campaigns from that domain will carry a DKIM signature with d=news.yourbrand.com.

That’s it. Mailchimp does not offer a custom Return-Path (bounce domain), so you cannot get SPF alignment. But DKIM alignment alone is sufficient for DMARC — DMARC only needs one aligned authentication method. After this setup, your campaigns will pass DMARC as long as your policy is set to p=none or higher.

What changes in your DMARC reports after setup

Before authentication, your DMARC aggregate reports show the following for each Mailchimp campaign:

• Source IP: one of Mailchimp’s sending IPs
• SPF: pass (domain: mailchimp.com)
• DKIM: pass (domain: mailchimp.com)
• DMARC: fail (alignment mismatch)

After you add the custom DKIM CNAMEs, the same campaign will show:

• Source IP: same Mailchimp IP (unchanged)
• SPF: pass (domain: mailchimp.com — still not aligned)
• DKIM: pass (domain: news.yourbrand.com — now aligned)
• DMARC: pass (because DKIM aligns)

You can verify this by checking your DMARC reports the day after activation. If you haven’t set up DMARC reporting yet, use a DMARC checker to see your current policy and report address.

Frequently asked questions

Can I use my root domain (e.g., yourbrand.com) instead of a subdomain?

Yes, but it’s riskier. If you ever want to switch ESPs or change sending practices, a subdomain like news.yourbrand.com isolates reputation and makes future changes easier. DMARC’s relaxed alignment mode (the default for most setups) allows any subdomain to align with the parent domain, so news.yourbrand.com works fine.

What if I have multiple Mailchimp accounts or multiple sending domains?

You need to authenticate each domain separately. Each account or subaccount can have its own authenticated domain. The process is the same: add the CNAMEs for each domain.

Does Mailchimp support DMARC enforcement?

Mailchimp does not enforce DMARC on your behalf — that’s your DNS policy. Once your domain is authenticated and DKIM is aligned, you can safely move your DMARC policy from p=none to p=quarantine or p=reject without breaking your campaigns.

Why doesn’t Mailchimp offer a custom Return-Path?

Some ESPs (like SendGrid) let you set a custom bounce domain for SPF alignment. Mailchimp currently does not. This means you rely entirely on DKIM for DMARC alignment. As long as your DKIM CNAMEs remain valid and your DNS doesn’t change, this is reliable.