DKIM record for Mailchimp

The DNS records

For Mailchimp marketing email, copy the Name and Value of CNAME 1 and CNAME 2 from the Domains page. The Transactional values are fixed.

Marketing: CNAME 1

Type: CNAME · Host: k2._domainkey Copy

<Value shown for CNAME 1 in Mailchimp>

Marketing: CNAME 2

Type: CNAME · Host: <Name shown for CNAME 2 in Mailchimp> Copy

<Value shown for CNAME 2 in Mailchimp>

Marketing: DMARC record

Type: TXT · Host: _dmarc Copy

<Value shown in Mailchimp, if you have no DMARC record yet>

A domain has one DMARC record. If you already publish one, keep it rather than adding a second.

Transactional: selector mte1

Type: CNAME · Host: mte1._domainkey Copy

dkim1.mandrillapp.com

Transactional: selector mte2

Type: CNAME · Host: mte2._domainkey Copy

dkim2.mandrillapp.com

Set it up and turn on signing

1. Verify the email domain first: Mailchimp requires verification before authentication.
2. Click your profile icon and choose Account & billing (account Managers choose Account), open the Domains tab, and click Start authentication next to the verified domain.
3. Pick your DNS provider. Mailchimp recommends its automatic option through Entri; to do it yourself, click Or manually authenticate your domain.
4. Copy CNAME 1 and CNAME 2 into your DNS, then the DMARC TXT record, clicking Next after each. The domain shows Authentication in progress and then Authenticated, usually within minutes and at most 48 hours.
5. Mailchimp Transactional: under the sending domain, click View DKIM settings, add the mte1 and mte2 CNAMEs, then click Test DNS Settings.

DMARC alignment

Until a domain is authenticated, Mailchimp authenticates your campaigns with its own domain, so DKIM passes for Mailchimp but not in alignment with your From address. After authentication, DMARC can pass on DKIM for your domain. Free mailbox addresses can't be authenticated at all: Mailchimp rewrites a Gmail or Yahoo From address to one of its own domains, because those providers' DMARC policies would otherwise reject the mail.

Key length and rotation

Both setups delegate the key to Mailchimp through CNAMEs, and Mailchimp doesn't publish a key length or rotation schedule. What it does document is that it records your CNAME values when you authenticate: if you change them afterward, disable authentication on the Domains page and authenticate again, or Mailchimp's records won't match DNS.

Common mistakes

• The domain appended twice. Mailchimp's example: entering k2._domainkey.example.com creates k2._domainkey.example.com.example.com. Enter k2._domainkey only.
• Editing the CNAMEs after authenticating without disabling and re-authenticating in Mailchimp.
• A second DMARC record. Keep a single _dmarc record; merge rather than add.
• Mixing up the products. Marketing and Transactional use different selectors; set up the pair for each product you send with.