# SPF record for Mailchimp Transactional (Mandrill)

URL: https://iblockspam.com/spf/mailchimp-transactional
Last updated: 2026-11-03

Include: None needed
Where it goes: Not needed (optional return-path CNAME)
DNS lookups: 0 on your domain

Mailchimp Transactional, the service formerly called Mandrill, doesn't ask you to add anything to your SPF record. Its current authentication docs ask for two DKIM CNAMEs (mte1._domainkey and mte2._domainkey), a DMARC policy and a mandrill_verify TXT record. For a return path on your own domain, add a CNAME on a subdomain pointing to mandrillapp.com.

## Example records

- Optional custom return-path domain (CNAME, not TXT) (CNAME, host mail): `mandrillapp.com` Mailchimp's example subdomain is mail.example.com. Then add it under Settings, Tracking & Return Path Domains.
- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- Your main domain on Google Workspace stays as it is (TXT, host @): `v=spf1 include:_spf.google.com ~all`

## Notes

- Since 15 March 2024, Mailchimp Transactional won't send from unverified domains or from domains without a valid DMARC policy and DKIM records.
- Mailchimp says a custom return-path domain must be a subdomain such as `mail.example.com`, never your root domain. You can also choose it per message with the `return_path_domain` API parameter or the `X-MC-ReturnPathDomain` SMTP header.
- The `mandrill_verify` TXT record proves you own the domain; it isn't an SPF record and doesn't start with `v=spf1`.

## How to add it

- In Mailchimp Transactional, go to **Settings**, choose **Domains**, type your sending domain and click **Add**.
- Click **View DKIM settings** and publish the two CNAMEs: `mte1._domainkey` to `dkim1.mandrillapp.com` and `mte2._domainkey` to `dkim2.mandrillapp.com`.
- Publish a DMARC TXT record on `_dmarc`. Mailchimp's minimum is `v=DMARC1; p=none`.
- Click **View details** to get your `mandrill_verify.` key, add it as a TXT record on the domain, then click **Test DNS Settings** until the domain shows three green checkmarks.
- Optionally, create a CNAME on a subdomain (not the root) pointing to `mandrillapp.com` and add it under **Settings > Tracking & Return Path Domains**.

## DKIM and DMARC

DKIM is the check that makes Mailchimp Transactional mail pass DMARC: the `mte1` and `mte2` CNAMEs let it sign with your domain. Without a custom return path, the bounce address sits on mandrillapp.com, so SPF passes for that domain and doesn't align with yours. A return-path subdomain of your From domain can align under DMARC's relaxed default. The Mailchimp marketing records are different; see our [Mailchimp DKIM page](https://iblockspam.com/dkim/mailchimp).

## Common mistakes

- Adding a Mandrill include to your root record because an older guide said so. Mailchimp's current Transactional docs don't ask for one, and every include spends DNS lookups.
- Pointing your root domain at `mandrillapp.com` as the return path. Mailchimp says to use a subdomain, and a CNAME at the root would break your other records.
- Treating the `mandrill_verify` TXT record as SPF and merging it into your `v=spf1` record. It is a separate TXT record.

**Q: Does Mandrill need include:spf.mandrillapp.com in my SPF record?**
Mailchimp's current Transactional authentication docs don't ask for it. They require two DKIM CNAMEs, a DMARC policy and domain verification. Leave your root SPF record unchanged unless you have a specific reason to add the include.

**Q: What is the Mailchimp Transactional return-path CNAME?**
A CNAME on a subdomain of yours, such as `mail.example.com`, pointing to `mandrillapp.com`. Add it under Settings, Tracking & Return Path Domains, then click Test DNS Settings. Bounces then use your subdomain instead of mandrillapp.com.

**Q: Why does Mailchimp Transactional reject my messages as unsigned?**
Mailchimp says an `unsigned` rejection means the sending domain hasn't been set up properly. It won't send from domains that are unverified or lack valid DKIM records and a DMARC policy, so check all three on the Sending Domains page.

Sources:
- Mailchimp Developer: Mailchimp Transactional authentication and delivery: https://mailchimp.com/developer/transactional/docs/authentication-delivery/
- Mailchimp Developer release notes: new sending domain authentication requirements (19 December 2023): https://mailchimp.com/developer/release-notes/2023/12/19

---

Source: iBlockSpam, https://iblockspam.com/spf/mailchimp-transactional (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt