Mailchimp Transactional (Mandrill) email authentication: SPF, DKIM and DMARC
Mailchimp Transactional, still known as Mandrill, wants a verification TXT record, an SPF include, two DKIM CNAMEs and a DMARC record on every sending domain. This guide gives each one, with the lookup cost of the SPF include.
Record values checked against Mailchimp Transactional (Mandrill)’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Mailchimp Transactional (Mandrill)
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
SPF for Mailchimp Transactional (Mandrill)
The mechanism to add is include:mandrillapp.com. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.
Mailchimp Transactional (Mandrill) is your only sender
v=spf1 include:mandrillapp.com ~allMerging into an existing record
Before
v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~allAfter
v=spf1 ip4:203.0.113.25 include:mandrillapp.com include:_spf.crm.example ~allLookup budget
SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 2 DNS lookups (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 8 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.
- Mailchimp’s SPF guide says to add include:mandrillapp.com after your other includes and before the ~all element. Its example is v=spf1 include:_spf.google.com include:mandrillapp.com ~all.
- The include costs 2 DNS lookups in total, measured on the verification date: mandrillapp.com itself, and the spf.mandrillapp.com record it points to.
- Keep one SPF record per domain. Add the Mandrill include to the existing one.
DKIM for Mailchimp Transactional (Mandrill)
Where: Mailchimp Transactional (Mandrill) dashboard: sending domains
- Add the sending domain in the Mandrill dashboard and publish the verification TXT record it shows (it looks like mandrill_verify.<key>).
- Run Test DNS Settings in the dashboard to check the verification record.
- Add the two DKIM CNAME records at your DNS host.
- Add the SPF include and the DMARC record, then re-run the DNS test.
| Type | Name | Value |
|---|---|---|
| CNAME | mte1._domainkey | dkim1.mandrillapp.com |
| CNAME | mte2._domainkey | dkim2.mandrillapp.com |
Selector. Mandrill signs with the selectors mte1 and mte2, published as CNAMEs to dkim1.mandrillapp.com and dkim2.mandrillapp.com.
- The verification key (mandrill_verify.<key>) is unique to your account. Copy it from the dashboard.
DMARC with Mailchimp Transactional (Mandrill)
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- Mailchimp’s documentation says DMARC uses DKIM to evaluate the authenticity of messages, and that a policy of p=none (fails are delivered normally) is acceptable. v=DMARC1; p=none is its recommended minimum.
- p=none is a start, not a protection level. Add a rua address and ramp up using the steps below.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Domain verification
Every sending domain has to be verified in the Mandrill dashboard with a TXT record before it sends.
| Type | Name | Value |
|---|---|---|
| TXT | @ | mandrill_verify.<key from the dashboard>Check it with Test DNS Settings in the dashboard. |
Common Mailchimp Transactional (Mandrill) mistakes
- Adding the Mandrill include to a second SPF record instead of the existing one.
- Putting include:mandrillapp.com after the ~all term. Everything after all is ignored.
- Typing spf.mandrillapp.com into the DKIM CNAME target, or the DKIM hosts into the SPF record. The DKIM targets are dkim1 and dkim2.mandrillapp.com.
- Leaving the domain unverified. The verification TXT has to be in place before sending.
- Stopping at p=none. It reports but does not protect.
Mailchimp Transactional (Mandrill) email authentication FAQ
What SPF include does Mandrill use?
include:mandrillapp.com, placed after your other includes and before the all term. It costs 2 DNS lookups on the verification date.
What DKIM records does Mailchimp Transactional use?
Two CNAME records: mte1._domainkey pointing to dkim1.mandrillapp.com and mte2._domainkey pointing to dkim2.mandrillapp.com.
What DMARC policy does Mandrill accept?
Mailchimp documents v=DMARC1; p=none as the minimum, where messages that fail are delivered normally. Plan to move to quarantine and reject once reports are clean.
Is Mandrill the same as Mailchimp Transactional?
Yes. Mailchimp Transactional is the current name of the Mandrill email API, and its sending domains still use mandrillapp.com hosts.
Can I have SPF records for both Mailchimp Transactional (Mandrill) and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Mailchimp Transactional (Mandrill) authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.