SPF, DKIM & DMARC for Mandrill (Mailchimp Transactional).
Mandrill — now sold as Mailchimp Transactional, a paid add-on to a Mailchimp Marketing account — authenticates your sending domain under Settings → Domains → Sending Domains, not through a single one-click wizard. Since March 15, 2024 the real setup is three things: two DKIM CNAME records (mte1._domainkey and mte2._domainkey, pointing at dkim1.mandrillapp.com and dkim2.mandrillapp.com), a DMARC policy record, and the shared SPF include (include:spf.mandrillapp.com) on the domain in your From address. Optionally, a custom return-path/tracking subdomain that CNAMEs to mandrillapp.com adds SPF alignment and branded open/click links. Once you click Test DNS Settings and everything resolves, Mandrill signs and sends as your own domain — instead of rewriting your From address to a mandrillapp.com subdomain, which is exactly what it now does to any unauthenticated domain.
Why authenticate Mandrill (Mailchimp Transactional)?
Authenticating your Mandrill sending domain is what keeps transactional mail — password resets, receipts, shipping notices — out of the spam folder, and Mailchimp now enforces it directly. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft extended equivalent rules to its consumer inboxes (Outlook/Hotmail/Live) in 2025. Mailchimp responded on March 15, 2024 with its own enforcement: sending domains must publish the two DKIM CNAMEs and a DMARC record, or Mandrill stops sending as your domain and instead rewrites the From address to a mandrillapp.com subdomain (replies still route back to you, but your domain earns no reputation and recipients see mail that isn't really from you). There's a Mandrill-specific catch that makes DKIM non-negotiable: by default the envelope sender / Return-Path lives on a mandrillapp.com bounce domain, so SPF passes but never aligns to your domain — DKIM is the only mechanism carrying your DMARC pass unless you also configure a custom return-path. Get DKIM, SPF, and DMARC in place and both your reputation and your inbox placement accrue to your own domain.
The SPF reality for Mandrill (Mailchimp Transactional)
Mandrill is a genuine "include" provider — and this is where it differs sharply from its sibling, Mailchimp Marketing (which is CNAME-only and needs no SPF include). Mailchimp Transactional explicitly requires include:spf.mandrillapp.com in the SPF record of your From domain — whether you use the default mandrillapp.com return-path or configure a custom one for alignment. Publish it inside the single SPF TXT record on the domain, e.g. v=spf1 include:spf.mandrillapp.com ~all, merging it into any existing v=spf1 line rather than adding a second SPF record. The good news on lookups: spf.mandrillapp.com resolves to a flat record containing only ip4: ranges and ~all — no nested includes — so it costs exactly ONE of your 10 SPF DNS lookups, not the several that some older guides imply. The important caveat: this include makes the raw SPF check pass against Mandrill's IPs, but by default your messages use a mandrillapp.com bounce domain as the Return-Path, so SPF is checked against Mandrill's domain and does NOT align with your organizational domain. An unaligned SPF pass contributes nothing to DMARC on its own — that's why Mandrill's flow leans on the DKIM CNAMEs, which DO align. If you want SPF to align too (and to survive some forwarding scenarios), set up a custom return-path/tracking subdomain (a CNAME on a subdomain pointing to mandrillapp.com); that moves the Return-Path onto your own domain so SPF aligns. So: the include is required and belongs on your root SPF, but treat DKIM as the load-bearing mechanism and add the custom return-path only if you need aligned SPF.
Two ways to set it up
DKIM alignment only (Mailchimp's default)
- The required minimum since March 15, 2024: two DKIM CNAMEs (mte1/mte2), the SPF include, and a DMARC record — no extra subdomain.
- Mandrill's DKIM signs as d=yourdomain.com through the mte1/mte2 selectors, so it aligns and DMARC passes on DKIM alone.
- The Return-Path stays on a mandrillapp.com bounce domain, so SPF passes but doesn't align — that's fine; DKIM carries the DMARC pass.
- Fewest records to manage, and enough to stop the From-address rewrite and satisfy Gmail, Yahoo, and Microsoft.
Add a custom return-path / tracking subdomain
- One extra CNAME on a subdomain (e.g. mail.yourdomain.com → mandrillapp.com) moves the Return-Path onto your own domain.
- Now SPF aligns too, so DMARC can pass on both SPF and DKIM — more resilient to forwarding that can break a DKIM signature.
- Also gives branded open/click tracking links on your own domain instead of mandrillapp.com.
- Must be a subdomain (never the apex), set to DNS-only on Cloudflare, and it has its own separate Test DNS Settings button to run.
Step by step
- 1
Open the Sending Domains page
Sign in to Mailchimp, open the Mailchimp Transactional (Mandrill) add-on (mandrillapp.com), then go to Settings → Domains → Sending Domains. If the domain in your From address isn't listed, enter it in the 'Add a sending domain' box and click Add. This is a paid add-on, so you'll need an active Transactional plan / API key.
- 2
Reveal the DKIM and SPF records
Next to your sending domain, open the DNS instructions (a 'View DKIM & SPF setup instructions' link / the SPF and DKIM columns). Mandrill displays the two DKIM CNAMEs and the SPF include for your domain. Leave this open — you'll come back to click Test DNS Settings.
- 3
Add the two DKIM CNAME records
At your DNS host create two CNAME records: host mte1._domainkey → value dkim1.mandrillapp.com, and host mte2._domainkey → value dkim2.mandrillapp.com. Keep the type as CNAME (don't switch to TXT). These two records have been the required DKIM method since March 15, 2024 — they replace the old single mandrill._domainkey TXT key.
- 4
Add or merge the SPF include
On the root domain (host @ or blank) add a TXT record v=spf1 include:spf.mandrillapp.com ~all. If a v=spf1 record already exists (Google Workspace, Microsoft 365, another relay), merge include:spf.mandrillapp.com into that single line — never publish a second SPF TXT record. It costs just one DNS lookup.
- 5
Publish the DMARC record
Mandrill doesn't create DMARC for you, and since March 15, 2024 a policy is required. Add a TXT record at host _dmarc with at least v=DMARC1; p=none — in practice use v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com so you also receive aggregate reports. Skip this only if a _dmarc record already exists (a domain must have exactly one).
- 6
(Optional) Add a custom return-path / tracking domain
For SPF alignment and branded open/click links, in Mandrill go to Settings → Domains and open the Tracking Domains section (this is also where custom return-path / bounce domains are configured), add a subdomain such as mail.yourdomain.com or track.yourdomain.com, then create a CNAME record with that subdomain as the host pointing to mandrillapp.com. It MUST be a subdomain — never CNAME your root domain. This moves the Return-Path onto your domain so SPF aligns.
- 7
Fix host doubling and the Cloudflare proxy
If your registrar auto-appends the domain, enter just the label (mte1._domainkey, not mte1._domainkey.yourdomain.com) to avoid doubling. On Cloudflare, set every Mandrill CNAME (the two DKIM records and any return-path/tracking CNAME) to 'DNS only' (grey cloud) — an orange-cloud proxied CNAME won't resolve to mandrillapp.com and Test DNS Settings will fail.
- 8
Click Test DNS Settings
Back in Sending Domains, click Test DNS Settings; the SPF and DKIM columns should flip to valid/verified once the records resolve (usually minutes, up to 24–48 hours). The Tracking/return-path screen has its own separate Test DNS Settings button — run that too if you set up a custom return-path.
- 9
Send a test and read the headers
Send a message through the Mandrill API or SMTP from an address on your authenticated domain, open it in Gmail, and choose ⋮ → Show original. You want DKIM: PASS with d=yourdomain.com (via the mte1/mte2 selector) and DMARC: PASS. Unless you added a custom return-path, the SPF / mailed-by line will show mandrillapp.com and read as not aligned — that's expected; DKIM is carrying the DMARC pass.
Records to add
Mandrill (Mailchimp Transactional) generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:spf.mandrillapp.com ~allRoot SPF — required on your From domain. Keep exactly one SPF record; merge this include if you already have a v=spf1 line. Costs 1 DNS lookup. Passes but doesn't align unless you add a custom return-path. |
| CNAME | mte1._domainkey | dkim1.mandrillapp.comDKIM key 1 — required since March 15, 2024. Delegated via CNAME so Mandrill manages the key; signs as d=yourdomain.com so it aligns. |
| CNAME | mte2._domainkey | dkim2.mandrillapp.comDKIM key 2 — the paired selector Mandrill uses to rotate keys. Add both CNAMEs; don't use the legacy mandrill._domainkey TXT. |
| CNAME | mandrillapp.comOptional custom return-path / tracking subdomain (illustrative host). Gives SPF alignment + branded links. MUST be a subdomain — never CNAME the root domain. | |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comRequired minimum since March 15, 2024 (p=none at least). One per domain; you add it yourself — Mandrill never creates it. Ramp to quarantine/reject later. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Mandrill (Mailchimp Transactional)'s setup costs against that budget.
Mandrill (Mailchimp Transactional) adds 1 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM is the mechanism that actually carries your DMARC pass on Mandrill, and its setup changed in 2024. The legacy method — which older tutorials still describe — was a single TXT record at mandrill._domainkey.yourdomain.com holding a shared Mandrill public key. That is deprecated. Since March 15, 2024 the required setup is two CNAME records: mte1._domainkey pointing to dkim1.mandrillapp.com and mte2._domainkey pointing to dkim2.mandrillapp.com. Because these are CNAMEs delegated to Mandrill (not TXT records you paste), Mandrill holds and rotates the underlying keys — dkim1.mandrillapp.com and dkim2.mandrillapp.com resolve to the actual DKIM public keys (v=DKIM1; k=rsa; p=…), and Mandrill signs your outbound mail with d=yourdomain.com. The signature aligns to your domain because the mte1/mte2 selectors live on your domain, even though the key material is Mandrill's shared infrastructure. Workflow: reveal the two CNAMEs in Sending Domains, publish both at your DNS host (grey-cloud/DNS-only if you're on Cloudflare, and enter just the label to avoid host doubling), then click Test DNS Settings. Don't mix methods: add the two mte1/mte2 CNAMEs and remove any old mandrill._domainkey TXT record if one lingers from a previous setup.
DMARC
DMARC is a separate policy TXT record on your domain that Mandrill does not create for you — and since March 15, 2024 it's required, not optional. Publish it at _dmarc.yourdomain.com starting with v=DMARC1; p=none (Mailchimp's stated minimum), and in practice add a reporting address: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only — it changes nothing about delivery while you watch the aggregate (rua) reports to confirm Mandrill mail is passing DKIM aligned to your domain. Because Mandrill's DKIM signs as d=yourdomain.com through the mte1/mte2 selectors, you should see clean DKIM-based DMARC passes quickly even though SPF won't align by default. Watch the reports for a week or two, make sure every legitimate sender (Mandrill plus any Google Workspace / Microsoft 365 / marketing tool) is authenticating, then tighten to p=quarantine and eventually p=reject. Keep exactly one _dmarc record for the whole organizational domain — never add a second one specifically for Mandrill; subdomains inherit the parent policy unless you override with their own _dmarc record.
Check it actually worked
Don't trust the dashboard's green checks alone — confirm authentication on a real message. In Mandrill, Settings → Domains → Sending Domains has a Test DNS Settings button that validates SPF and DKIM; the Tracking/return-path screen has its own separate Test DNS Settings button if you configured a custom return-path. Then send a message through the Mandrill API or SMTP from an address on your authenticated domain, open it in Gmail, and choose ⋮ → Show original: you want DKIM: PASS with d=yourdomain.com (via the mte1/mte2 selector) and DMARC: PASS. If you didn't set up a custom return-path, SPF / mailed-by will show mandrillapp.com and read as unaligned — that's expected, and DKIM carries the DMARC pass. Spot-check the raw records with dig CNAME mte1._domainkey.yourdomain.com and dig TXT _dmarc.yourdomain.com. Finally, run the domain through Qualisend's domain health check to confirm the SPF include, both DKIM CNAMEs, and the DMARC record all resolve and keep SPF under the 10-lookup limit, and once aggregate reports arrive, drop one into the DMARC report analyzer — Mailchimp Transactional / Mandrill should appear as an aligned, passing source.
Common gotchas
- DNS setup
The March 15, 2024 fallback: if you don't publish the two DKIM CNAMEs and a DMARC record, Mandrill stops sending as your domain and rewrites the From address to a mandrillapp.com subdomain (replies still route to you, but your domain earns no reputation). Completing DKIM + DMARC is what stops the rewrite.
- DNS setup
DKIM moved from TXT to CNAME. Old guides tell you to add a single TXT record at mandrill._domainkey with a shared public key — that's the legacy method. The current requirement is the two CNAMEs mte1._domainkey → dkim1.mandrillapp.com and mte2._domainkey → dkim2.mandrillapp.com. Don't mix the two.
- Breaks auth
SPF passes but doesn't align by default. include:spf.mandrillapp.com makes the raw SPF check pass against Mandrill's IPs, but the default Return-Path is a mandrillapp.com bounce domain, so SPF isn't aligned to your domain and does nothing for DMARC on its own. DKIM is the aligned mechanism — add a custom return-path subdomain only if you specifically need aligned SPF too.
- DNS setup
A custom return-path/tracking domain MUST be a subdomain. The CNAME to mandrillapp.com goes on something like mail.yourdomain.com — never CNAME your root/apex domain, which would hijack your entire zone (MX, web, everything).
- DNS setup
Cloudflare proxy breaks it: set the two DKIM CNAMEs (and any return-path/tracking CNAME) to 'DNS only' (grey cloud). An orange-cloud proxied CNAME won't resolve to mandrillapp.com and Test DNS Settings fails.
- Breaks auth
Keep exactly one SPF record. If you already send via Google Workspace, Microsoft 365, or another relay, merge include:spf.mandrillapp.com into that single v=spf1 line — two SPF TXT records is a PermError. It's one DNS lookup, so it stacks cheaply.
- DNS setup
Mandrill is NOT the same as Mailchimp Marketing domain authentication. They're separate products with different records: Mailchimp Marketing uses k2/k3._domainkey CNAMEs (to dkim2/dkim3.mcsv.net) and no SPF include, while Mandrill uses mte1/mte2._domainkey CNAMEs and DOES require include:spf.mandrillapp.com. Set up whichever you actually send through (or both — they don't conflict).
- DNS setup
Host-field doubling: many registrars auto-append your domain, so entering mte1._domainkey.yourdomain.com becomes mte1._domainkey.yourdomain.com.yourdomain.com. Enter just the label (mte1._domainkey, mte2._domainkey) when the panel adds the domain for you.
Build your SPF record
Mandrill (Mailchimp Transactional) is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listMandrill (Mailchimp Transactional) SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.