SPF record for Mailchimp

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Mailchimp mail

Mailchimp sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• If your provider's interface adds your domain to the name automatically, enter only k2._domainkey (for example), not the full name, or you'll get k2._domainkey.example.com.example.com.
• If you change the CNAME records after authenticating, Mailchimp suggests disabling and re-authenticating the domain.

How to add it

1. In Mailchimp, verify your email domain from the Domains page.
2. Start authentication: use the automated setup Mailchimp offers, or choose manual setup.
3. For manual setup, copy the two CNAME records (DKIM) and the TXT record for _dmarc into your DNS host.
4. Back in Mailchimp, click through to finish; Mailchimp checks the records and shows the result on the Domains page.

DKIM and DMARC alignment

DKIM is what makes Mailchimp mail pass DMARC for your domain: the two CNAMEs let Mailchimp sign with your domain, so the DKIM result aligns with your From address. SPF passes on Mailchimp's own domain, which doesn't align with yours, and that is fine because DMARC needs only one aligned pass.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Mailchimp adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding an include for Mailchimp to your SPF record because an old guide said so. Mailchimp's current setup doesn't ask for one, and every unneeded include costs DNS lookups.