Mailchimp is two products under one name, and that is the leading cause of a botched setup: Marketing and Transactional (formerly Mandrill) require different records. Copying the ones from a tutorial leads straight to an « unauthenticated » domain with no explanation.
The records
In both cases, two DKIM CNAMEs, whose exact values are shown in the interface when you authenticate the domain. For Transactional they are fixed:
mte1._domainkey CNAME dkim1.mandrillapp.com
mte2._domainkey CNAME dkim2.mandrillapp.comFor Marketing they depend on your account: take them from the interface, they cannot be guessed. Allow up to 48 hours for Mailchimp to validate them.
What makes DMARC pass
Mailchimp sends with its own envelope address. An SPF record on your side, if you add one, will pass without aligning: it validates Mailchimp’s domain. It is DKIM, signed with a key published on your domain, that makes the message compliant. On an email platform, DKIM is therefore never optional.
Adding a Mailchimp include « just in case » consumes one of the ten permitted DNS lookups and changes nothing about alignment.
DMARC
Publish the monitoring policy on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:your-address@yourdomain.comOnly tighten once every sender is identified. The progression, step by step.
Common mistakes with Mailchimp
- Mixing up the Marketing and Transactional records. Both products often coexist in the same company; each has its own, and they do not substitute for one another.
- Concluding too early. Validation can take 48 hours: a check run the same evening proves nothing.
- Sending from an address on a domain other than the authenticated one — alignment is judged on the
From:. - A sending subdomain not covered by the policy: without
sp=, it inherits the parent domain’s and falls with it.
Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.