SPF record for Mailchimp Transactional (Mandrill)

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Optional custom return-path domain (CNAME, not TXT)

Type: CNAME · Host: mail Copy

mandrillapp.com

Mailchimp's example subdomain is mail.example.com. Then add it under Settings, Tracking & Return Path Domains.

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

Your main domain on Google Workspace stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

How SPF applies to Mandrill mail

Mandrill sends with a bounce (MAIL FROM) address on a domain it manages, so receivers check SPF there, not on your domain. You don't add anything to your SPF record for it; your domain is authenticated with DKIM instead.

• Since 15 March 2024, Mailchimp Transactional won't send from unverified domains or from domains without a valid DMARC policy and DKIM records.
• Mailchimp says a custom return-path domain must be a subdomain such as mail.example.com, never your root domain. You can also choose it per message with the return_path_domain API parameter or the X-MC-ReturnPathDomain SMTP header.
• The mandrill_verify TXT record proves you own the domain; it isn't an SPF record and doesn't start with v=spf1.

How to add it

1. In Mailchimp Transactional, go to Settings, choose Domains, type your sending domain and click Add.
2. Click View DKIM settings and publish the two CNAMEs: mte1._domainkey to dkim1.mandrillapp.com and mte2._domainkey to dkim2.mandrillapp.com.
3. Publish a DMARC TXT record on _dmarc. Mailchimp's minimum is v=DMARC1; p=none.
4. Click View details to get your mandrill_verify. key, add it as a TXT record on the domain, then click Test DNS Settings until the domain shows three green checkmarks.
5. Optionally, create a CNAME on a subdomain (not the root) pointing to mandrillapp.com and add it under Settings > Tracking & Return Path Domains.

DKIM and DMARC alignment

DKIM is the check that makes Mailchimp Transactional mail pass DMARC: the mte1 and mte2 CNAMEs let it sign with your domain. Without a custom return path, the bounce address sits on mandrillapp.com, so SPF passes for that domain and doesn't align with yours. A return-path subdomain of your From domain can align under DMARC's relaxed default. The Mailchimp marketing records are different; see our Mailchimp DKIM page.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Mandrill adds nothing to your count, which is one more reason not to add an include for it. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a Mandrill include to your root record because an older guide said so. Mailchimp's current Transactional docs don't ask for one, and every include spends DNS lookups.
• Pointing your root domain at mandrillapp.com as the return path. Mailchimp says to use a subdomain, and a CNAME at the root would break your other records.
• Treating the mandrill_verify TXT record as SPF and merging it into your v=spf1 record. It is a separate TXT record.