# DKIM record for Mailchimp

URL: https://iblockspam.com/dkim/mailchimp
Last updated: 2026-10-09

Record type: CNAME
Selectors: k2 and a second CNAME (Marketing), mte1, mte2 (Transactional)
Key managed by: Provider (CNAME delegation)

Mailchimp domain authentication asks for two DKIM CNAME records and one DMARC TXT record. The first CNAME is `k2._domainkey`; the account shows the second name and both targets. Mailchimp Transactional uses its own pair, `mte1._domainkey` and `mte2._domainkey`, pointing to `dkim1.mandrillapp.com` and `dkim2.mandrillapp.com`.

## DNS records

- Marketing: CNAME 1 (CNAME, host k2._domainkey): `<Value shown for CNAME 1 in Mailchimp>`
- Marketing: CNAME 2 (CNAME, host <Name shown for CNAME 2 in Mailchimp>): `<Value shown for CNAME 2 in Mailchimp>`
- Marketing: DMARC record (TXT, host _dmarc): `<Value shown in Mailchimp, if you have no DMARC record yet>` A domain has one DMARC record. If you already publish one, keep it rather than adding a second.
- Transactional: selector mte1 (CNAME, host mte1._domainkey): `dkim1.mandrillapp.com`
- Transactional: selector mte2 (CNAME, host mte2._domainkey): `dkim2.mandrillapp.com`

## Set it up and turn on signing

- Verify the email domain first: Mailchimp requires verification before authentication.
- Click your profile icon and choose **Account & billing** (account Managers choose **Account**), open the **Domains** tab, and click **Start authentication** next to the verified domain.
- Pick your DNS provider. Mailchimp recommends its automatic option through Entri; to do it yourself, click **Or manually authenticate your domain**.
- Copy CNAME 1 and CNAME 2 into your DNS, then the DMARC TXT record, clicking **Next** after each. The domain shows **Authentication in progress** and then **Authenticated**, usually within minutes and at most 48 hours.
- **Mailchimp Transactional:** under the sending domain, click **View DKIM settings**, add the `mte1` and `mte2` CNAMEs, then click **Test DNS Settings**.

## DMARC alignment

Until a domain is authenticated, Mailchimp authenticates your campaigns with its own domain, so DKIM passes for Mailchimp but not in alignment with your From address. After authentication, DMARC can pass on DKIM for your domain. Free mailbox addresses can't be authenticated at all: Mailchimp rewrites a Gmail or Yahoo From address to one of its own domains, because those providers' DMARC policies would otherwise reject the mail.

## Key length and rotation

Both setups delegate the key to Mailchimp through CNAMEs, and Mailchimp doesn't publish a key length or rotation schedule. What it does document is that it records your CNAME values when you authenticate: if you change them afterward, disable authentication on the Domains page and authenticate again, or Mailchimp's records won't match DNS.

## Common mistakes

- **The domain appended twice.** Mailchimp's example: entering `k2._domainkey.example.com` creates `k2._domainkey.example.com.example.com`. Enter `k2._domainkey` only.
- **Editing the CNAMEs after authenticating** without disabling and re-authenticating in Mailchimp.
- **A second DMARC record.** Keep a single `_dmarc` record; merge rather than add.
- **Mixing up the products.** Marketing and Transactional use different selectors; set up the pair for each product you send with.

**Q: Why does Mailchimp need a DMARC record to authenticate my domain?**
Mailchimp's manual setup includes one DMARC TXT record alongside the two DKIM CNAMEs. Gmail and Yahoo require DMARC from senders of more than 5,000 messages a day, and a domain with no DMARC record can't meet that.

**Q: Can I authenticate a Gmail or Yahoo address in Mailchimp?**
No. Authentication only works for domains you own and control. Mailchimp rewrites free mailbox From addresses to one of its own sending domains, because those providers' DMARC policies would otherwise reject the mail.

**Q: What DKIM records does Mailchimp Transactional (Mandrill) use?**
Two CNAMEs: `mte1._domainkey` pointing to `dkim1.mandrillapp.com` and `mte2._domainkey` pointing to `dkim2.mandrillapp.com`. After adding them, click Test DNS Settings next to the sending domain.

Sources:
- Mailchimp Help: Set up email domain authentication: https://mailchimp.com/help/set-up-email-domain-authentication/
- Mailchimp Help: About email domain authentication: https://mailchimp.com/help/about-email-authentication/
- Mailchimp Developer: Transactional authentication and delivery: https://mailchimp.com/developer/transactional/docs/authentication-delivery/
- Mailchimp Help: Limitations of free email addresses: https://mailchimp.com/help/limitations-of-free-email-addresses/

---

Source: iBlockSpam, https://iblockspam.com/dkim/mailchimp (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt