SPF record for Mailchimp Transactional

Mailchimp Transactional sends application and transactional mail through the Mandrill API or SMTP. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

There is no include to put on your root record. When I checked on 2026-09-04, Mailchimp's Transactional documentation set a sending domain up with two DKIM CNAMEs and a DMARC record, and asked for no SPF mechanism of yours.

SPF is checked against the return path, and by default that address sits on mandrillapp.com. The pass belongs to Mailchimp and does not align with your From domain, so DMARC passes on DKIM alone until you move the return path onto a subdomain of your own.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS-querying mechanisms across the whole nested chain, and going over turns the record into a permerror that authorises nothing. Our free SPF checker resolves the chain and gives you the number.

DKIM

Two CNAMEs, with the keys held at Mailchimp's end:

Publish both, then press Test DNS Settings against the sending domain. Older setups used one TXT record at mandrill._domainkey holding a key shared across accounts. If that is what your domain still carries, replace it with the pair above.

Return path and SPF alignment

A custom return path is one CNAME on a subdomain, pointed at mandrillapp.com. Mailchimp's documentation is explicit that it has to be a subdomain and not your root domain:

Add it under Settings, Tracking and Return Path Domains, then apply it on the Sending Defaults page or per message with the return_path_domain parameter. SPF is then checked against mail.example.com, which aligns with a From address at example.com under relaxed matching.

DMARC alignment with Mailchimp Transactional

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Mailchimp Transactional specifics:

• Mailchimp's campaign product and Mailchimp Transactional are separate, with separate records. Authenticating a domain in one does not authenticate it in the other.
• A tracking domain and a return-path domain are two different CNAMEs. Tracking changes the links inside the message and has no effect on DMARC.
• A return-path domain belongs to one Transactional account. Two accounts sending as the same domain need a subdomain each.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Mailchimp Transactional to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Mailchimp Transactional's own documentation, at Mailchimp Transactional documentation. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.