SPF record for Mailchimp

Mailchimp sends campaigns and automations from your audience. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

You don't need an SPF include for Mailchimp, so leave your SPF record alone. Mailchimp's domain authentication steps ask for two CNAME records for DKIM and one TXT record for DMARC, and they don't mention SPF. I checked them on 19 Sep 2026.

You'll still find advice to add include:servers.mcsv.net. It doesn't help DMARC. Receivers check SPF against the envelope sender, and Mailchimp sets that to its own bounce domain, so an SPF pass is a pass for Mailchimp's domain and never aligns with yours. Your mail passes DMARC on the DKIM signature.

If the include is already in your record, it does no harm and it costs one of your ten lookups. Remove it when you're close to the limit.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count.

DKIM

Mailchimp calls this domain authentication and hands you CNAME records under _domainkey whose names start with k and which point at dkim hosts on mcsv.net. The exact pair depends on when your account was set up, so copy them from Website, Domains, Authenticate rather than from any page including this one.

Once they resolve, Mailchimp signs with d=example.com and DMARC has an aligned identifier to work with.

DMARC alignment with Mailchimp

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Mandrill, the transactional side, is a separate product with separate records. Authenticating your domain in Mailchimp leaves Mandrill unauthenticated.
• Mailchimp will happily send from a free mailbox address. It fails DMARC at Gmail and Yahoo, both of which publish enforcing policies on their own consumer domains, so use an address on a domain you control.
• Verifying an email address proves you can read that mailbox. Authenticating a domain is a separate step, and it's the one that changes what receivers check.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Mailchimp to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Mailchimp's own documentation, at Mailchimp help. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.