DKIM and DMARC for Mailchimp: authenticate your sending domain
Add the two CNAME records and the DMARC record Mailchimp asks for, check that your campaigns are signed with your own domain, and keep DMARC from breaking them.
A campaign sent through Mailchimp from news@yourdomain.example is, by default, signed by Mailchimp’s own domains. It arrives, but it does not pass DMARC for your domain: the day you tighten your policy, your own newsletters are the first casualties. Authenticating the domain in Mailchimp fixes that. This guide follows Mailchimp’s help pages, read on 14 November 2026.
Verification is not authentication
Mailchimp asks for two different things. Verification proves you can read mail at the address (a link or a code); it is required to send, and changes nothing about delivery. Authentication is the DNS work below, and is what makes your mail pass DKIM and DMARC in your name. A domain marked as verified is not yet authenticated.
Only a domain you own can be authenticated: not a Gmail or Yahoo address.
1. Open the instructions
Click your profile icon, choose Account & billing, open the Domains tab, and click Start authentication next to the verified domain. Choose your DNS provider when asked.
Mailchimp offers two ways. The automatic one (through a service called Entri) logs in to your DNS provider and creates the records for you. The manual one shows you the records to copy; it is the one described here, and the one to prefer if you want to see exactly what is published.
2. Publish two CNAME records for DKIM
Mailchimp shows a Name and a Value for CNAME 1 and CNAME 2. Create both at your DNS provider, exactly as shown.
One trap: some providers add the domain to the name themselves. If you paste k2._domainkey.yourdomain.example and the provider creates k2._domainkey.yourdomain.example.yourdomain.example, enter only k2._domainkey.
3. Publish the DMARC record
Mailchimp then shows one TXT record for the host _dmarc. Before you paste it, check whether your domain already has a DMARC record: a domain must have one only, and two cancel each other. If you already have one, keep yours, and simply make sure it exists.
Gmail and Yahoo require a published DMARC record from anyone who sends more than 5,000 messages a day to their users, and authentication in the sender’s own name.
4. Confirm
Back in Mailchimp, finish the steps and wait for the validation. When it works, the label Authenticated appears next to the domain. If it fails, Mailchimp offers to resolve or restart.
Then send a real campaign to a mailbox of your own and look at the headers: dkim=pass with your domain. The e-mail header analyzer reads them for you, and the DKIM record checker looks up the selector.
What goes wrong
- The CNAME was doubled by the DNS provider (see above).
- The records were changed after authentication: Mailchimp keeps what it validated; editing the CNAME records later can break the signature.
- Two DMARC records: receivers ignore both. Keep one.
- Mailchimp passes, DMARC still fails: another service sends in your name. The DMARC report reader shows which one.
Once your mailbox provider and Mailchimp both sign with your domain, follow From p=none to p=reject.