Mailchimp DKIM Setup: Authenticate Your Domain, Properly

Last updated: October 2026

If your Mailchimp campaigns land in spam — or arrive showing "via mcsv.net" next to your name — your domain isn't authenticated. Authentication is what lets Mailchimp send as your domain in a way receivers can verify: SPF to authorize Mailchimp's servers, DKIM to sign the campaigns with your domain, and the two together to pass DMARC. This guide does the full job, including the part most walkthroughs skip: confirming the result is aligned, not just present.

What you're adding, and why

Two kinds of DNS changes, both displayed by Mailchimp for your specific account:

• SPF: add include:servers.mcsv.net to your domain's existing SPF record. Not a new record — your domain gets exactly one SPF record, and this merges into it. (Counted from the live record, Mailchimp's include costs just 1 of your 10 allowed DNS lookups, so it's cheap to carry.)
• DKIM: add the CNAME records Mailchimp shows you, which point receivers to Mailchimp's signing keys for your domain.

Step 1: Start authentication in Mailchimp

1. In Mailchimp, go to Settings → Domains and find your domain under Verified Domains. (If it isn't verified yet, do that first — Mailchimp emails you a confirmation.)
2. Click "Authenticate" next to the domain. A panel shows the exact records your account needs.
3. Leave this panel open — you'll copy values from it directly into your DNS. Never type them from memory or from a screenshot in a guide; values differ between accounts.

Step 2: The DKIM CNAMEs — k1 vs k2/k3

Here's where most people get stuck, because Mailchimp's setup changed across account generations and old guides show old records:

• Current accounts are shown two CNAMEs: k2._domainkey pointing to dkim2.mcsv.net, and k3._domainkey pointing to dkim3.mcsv.net.
• Older accounts may show a single CNAME: k1._domainkey pointing to dkim.mcsv.net.

Neither set is "wrong" — but the only correct records for you are the ones your Authenticate panel displays. Add them at your DNS host exactly as shown: record type CNAME, host exactly as given (most DNS panels want just k2._domainkey, not the full domain — if your panel appends your domain automatically, entering the whole thing creates a doubled name that never resolves). If your DNS lives on Cloudflare, set these CNAMEs to DNS only (grey cloud); a proxied CNAME breaks the lookup.

Step 3: Merge the SPF include

Open your domain's existing SPF record (a TXT record at the root starting v=spf1). Add include:servers.mcsv.net before the ending ~all or -all. A typical merged record with Google Workspace looks like:

If no SPF record exists yet, create one TXT record at the root with just v=spf1 include:servers.mcsv.net ~all — but check first: a record probably exists from your mailbox setup, and creating a second one breaks SPF entirely. Our wizard builds the merged record for your whole sender list and counts the lookups.

Step 4: Verify in Mailchimp — then verify for real

Back in the Authenticate panel, click "Authenticate Domain." Mailchimp checks DNS; propagation can take from a few minutes to a few hours, so a failure in the first minutes usually means "not visible yet," not "wrong." Wait for the confirmed/authenticated status before sending.

Then do the check that actually matters. Send a test campaign to a Gmail address, open it, click the three dots → "Show original." You want three PASSes, and next to DKIM, your domain — not mcsv.net. That distinction is DMARC alignment: DKIM passing for Mailchimp's domain doesn't help your domain's DMARC; DKIM passing with your domain as the signer does. If the panel says authenticated but "Show original" disagrees, the CNAMEs aren't resolving as published (the doubled-host and proxied-CNAME traps above are the usual causes).