How to authenticate your domain in Mailchimp

Here is the short version: by default Mailchimp signs your campaigns with its own domain, so Gmail shows “via mailchimp.com” and DMARC can fail for your brand. Domain authentication tells Mailchimp to DKIM-sign as your domain and lets you point a custom Return-Path at Mailchimp’s bounce servers. Once both align to the address your subscribers actually see, the “via” label goes away and a strict DMARC policy stops rejecting your own newsletters. This guide covers what the records are, where to start in Mailchimp, and how to confirm it worked.

The records Mailchimp needs

Mailchimp handles authentication through a small number of DNS records. The exact hostnames and target values are generated per account — always copy the ones Mailchimp shows you in its own screen rather than the placeholders below.

DKIM (CNAME). Mailchimp gives you CNAME records at selectors like k1, k2 and k3 under _domainkey. They point at Mailchimp’s DNS, which serves the public key. This is what lets Mailchimp sign as your domain:

Type: CNAME Host: k1._domainkey.example.com Value: dkim.mcsv.net        (use the exact target from your Mailchimp screen)

Custom Return-Path / SPF alignment (CNAME). To get SPF to align to your domain — and to fully remove the “via” label — Mailchimp has you add a CNAME (often on a mail or bounce subdomain) that delegates the envelope sender to Mailchimp’s bounce infrastructure:

Type: CNAME Host: mail.example.com Value: (the exact bounce target from your Mailchimp dashboard)

You generally do not need to add include:servers.mcsv.net to your own SPF record when you use Mailchimp’s custom Return-Path, because SPF is then checked against Mailchimp’s bounce domain that the CNAME points to. The DKIM CNAME is the part that matters most for DMARC — see below.

Where to start in Mailchimp

In Mailchimp, open the Website & Domains (or Domains) section from your account settings, add your sending domain, and choose to authenticate it. Mailchimp verifies you own the mailbox first, then displays the exact CNAME records to copy into your DNS host. Paste each one at your registrar or DNS provider — if that’s Cloudflare, GoDaddy or Namecheap, we have step-by-step guides linked below — then return to Mailchimp and click to verify. Propagation is usually minutes but can take up to a day. Follow Mailchimp’s own current screens: Set up custom domain authentication (DKIM and SPF).

Why DMARC alignment matters here

DMARC only passes when SPF or DKIM not only passes but also aligns — the authenticated domain has to match the visible From: your readers see. Unauthenticated Mailchimp mail is signed by mailchimp.com, which does not align with you@example.com, so under a p=quarantine or p=reject policy your own campaigns can be junked or bounced. Adding the DKIM CNAME makes Mailchimp sign as example.com, which aligns, and aligned DKIM survives forwarding where SPF doesn’t. If you want the full picture of why a valid signature can still fail DMARC, read why DKIM passes but DMARC fails, and for the Return-Path side see how to set up a custom Return-Path. If you don’t have a DMARC record yet, build a safe starter with the DMARC Generator and read the complete SPF/DKIM/DMARC guide first.

Verify it worked

Once Mailchimp reports the domain authenticated, confirm it independently rather than trusting the dashboard alone:

• Check the DKIM key is live and resolves with the DKIM Checker (query the k1._domainkey selector).
• Confirm your SPF record is valid and under the ten-lookup limit with the SPF Checker.
• Validate your policy with the DMARC Checker, then send yourself a real test campaign and check the header shows dkim=pass aligned to your domain and no “via mailchimp.com”.

To watch results over time and catch a broken sender before it becomes a wave of spam-foldering, keep DMARC monitoring running.

Common mistakes

• Leaving the “via mailchimp.com” label. That label appears when Gmail sees the signing/Return-Path domain differ from your From. It disappears only after both the DKIM CNAME and the custom Return-Path are authenticated — adding just one often isn’t enough.
• Skipping DMARC entirely. Authentication without a DMARC record means receivers have no policy to act on. Publish at least p=none so you get reports, then ramp up.
• Pasting the CNAME target with your domain appended. Some DNS panels auto-append your domain to the value. The Mailchimp target ends in .mcsv.net (or similar) and must stay exactly as given — no trailing example.com.
• Proxying the CNAME. On Cloudflare, keep these records DNS-only (grey cloud), never proxied — see adding records in Cloudflare.
• Publishing a second SPF record. You may only have one v=spf1 record. If you already have one, merge, don’t add a second.
• Assuming authentication fixes spam placement on its own. It’s necessary but not sufficient — verify your list with the Email Verifier and watch reputation too.

Related setup guides: Mailgun, Postmark, Brevo, Klaviyo and Zoho Mail.