How to Set Up DKIM for Mailchimp

The order matters: Mailchimp first, DNS second

Mailchimp must generate the records for the specific sending domain before anything is published in DNS. A record copied from another domain, another account, or a walkthrough will not authenticate this domain, because the records are tied to the domain entry and its current authentication state in that account.

1. Verify the domain. Add the sending domain in Mailchimp's Domains section and complete verification — an email link or code to an address on the domain. Verify every domain that appears in a visible From address; one working domain does not cover the others in the account.
2. Start authentication. Beside the verified domain, start authentication. Mailchimp offers an automatic DNS connection (through Entri) or manual authentication. Choose manual if the DNS provider is not supported by the automatic path or if the records must be reviewed before publishing.
3. Copy the generated records exactly. Mailchimp displays the CNAME records for that domain. Copy the host names and the target values character for character into the domain's DNS zone, at the DNS host, not the registrar, where the two differ.
4. Disable proxying. If the DNS provider offers proxying or traffic masking (the orange-cloud style setting), disable it for these records. DKIM records must be publicly readable for receiving servers to retrieve the public keys.
5. Wait and confirm. DNS propagation takes minutes to 48 hours. Mailchimp checks periodically and updates the domain status to authenticated once the records are found. Confirm with a small live send to addresses you control, checking the received headers for a DKIM pass and a DMARC pass.

The selector question, answered honestly

Published walkthroughs disagree: most current campaign-authentication accounts show two CNAME records, while older accounts and Mailchimp Transactional setups show three selectors (k1, k2, k3) or the mte1/mte2 selectors pointing at mandrillapp.com. All three patterns exist because Mailchimp has rotated selectors over time and the products differ. The correct answer for a given domain is the one the account displays for that domain today. This guide states no literal selector hostnames or targets, because any literal stated here would be wrong for some accounts. Copy what the account shows.

DKIM, SPF, and DMARC — the three, kept apart

DKIM signs the message with the sending domain's key, and alignment between the DKIM domain and the From domain is what DMARC checks. Mailchimp uses its own return-path domain, so SPF does not align for Mailchimp sends — an SPF failure alongside a DKIM pass is expected and does not block delivery. Do not add a Mailchimp SPF include to the From domain expecting it to fix alignment; it does not change the return-path domain. A DMARC TXT policy is a separate record: keep an existing valid DMARC record rather than adding a duplicate, and add one only if the domain needs one. Authentication gives the receiving system a domain identity that matches the From address; DKIM is the mechanism that makes it pass.

If authentication does not complete

Check, in order: the records were published at the DNS host serving the domain (not a parked name server); the host names and targets match the account display exactly, including any trailing dots the provider requires; proxying is disabled on both records; and enough time has passed — up to 48 hours. A record that looks right but is proxied, or published at the wrong DNS host, is the most common cause. Re-check the account display before re-publishing: if the authentication state was reset, Mailchimp may have generated fresh values.

For generic DKIM records outside Mailchimp, use the on-site DKIM Record Generator. For other Mailchimp destinations, see the Mailchimp Export Guides by Format directory.

Source

Sources: Mailchimp domain verification and authentication flow (verify-then-authenticate order, automatic Entri connection or manual CNAME records, per-domain records, propagation up to 48 hours, proxying must be disabled) as stated consistently across secondary walkthroughs read 2026-11-01 and the Mailchimp Transactional authentication documentation (two CNAME records, mte1/mte2 selectors, Test DNS Settings); Mailchimp DKIM selector history (two-record current accounts vs k1/k2/k3 and Transactional selectors) as stated across the same sources, with the conflict disclosed rather than resolved. Facts verified 2026-11-01 as secondary-sourced. Open flags: no mailchimp.com campaign-product DKIM help page was opened in this run — the flow is secondary-sourced and is flagged for primary re-verification against Mailchimp's help pages; no literal selector hostnames or targets are carried, deliberately, because the sources conflict.

This page explains how the process works and what the official rules say. It is general information, not legal advice. For a dispute about your specific situation, talk to your state motor vehicle agency or court.