Mailchimp and Mandrill SPF: why the current docs don't ask for an include

Plenty of client SPF records still carry a Mailchimp-era include from years ago. Neither Mailchimp's current marketing help nor the Mailchimp Transactional (formerly Mandrill) developer docs asks you to add an SPF include to your domain. Both are built around DKIM through CNAME records, plus a DMARC record. If a client asks "what's the Mailchimp SPF include?", the honest answer is that Mailchimp's own setup guides no longer use one. This page covers what those guides ask for instead.

Mailchimp Marketing: two CNAMEs and a DMARC TXT

Mailchimp's help article on email domain authentication says manual setup "still requires you to add 2 CNAME records and 1 TXT record." The two CNAMEs are the DKIM records, and the TXT is a DMARC record at _dmarc. Mailchimp also offers automated setup through Entri, which writes the same records through the DNS provider's login.

The exact CNAME host names and targets appear in the client's Mailchimp account under the domain's authentication instructions. Copy them from there rather than from a blog post. Mailchimp's help uses k2._domainkey as an example host name and warns about a common DNS-panel problem: if the panel appends the zone name automatically, entering the full name creates k2._domainkey.example.com.example.com. The fix is to enter just k2._domainkey.

Mailchimp also separates two steps:

• Verification proves you control the address or domain. Mailchimp says it doesn't affect delivery.
• Authentication (the DNS records) is what affects deliverability.

Mailchimp's help notes that Gmail and Yahoo require authentication, plus a published DMARC record for senders of more than 5,000 messages a day to their users. Google's own sender guidelines say the same for Gmail.

Mailchimp Transactional (Mandrill): DKIM CNAMEs, DMARC, optional return-path

The Transactional developer docs describe three pieces:

On top of that, the docs say you're required to have a DMARC policy, and that it "can be set with p=none in relaxed mode." Mailchimp Transactional only requires that a record exists. It doesn't ask for enforcement.

Custom return-path domain (optional). By default, the return-path (envelope sender, which SPF checks) points to mandrillapp.com. You can change that by creating a CNAME from a subdomain, such as mc.client.com, to mandrillapp.com and adding it under Settings → Tracking & Return Path Domains. Mailchimp says it has to be a subdomain, not the root domain, and that each return-path domain can belong to only one Transactional account. Mailchimp calls the change "often considered a cosmetic change." Bounces are still handled by Mailchimp.

Where SPF fits, then

SPF checks the envelope sender, not the visible From: address. When the envelope sender is Mailchimp's domain, receivers check Mailchimp's SPF record and never look at the client's. So an include on the client's apex doesn't help Mailchimp mail pass SPF. It only spends DNS lookups toward the RFC 7208 limit of 10.

Under DMARC (RFC 9989), a message passes if SPF or DKIM passes and the authenticated domain aligns with the From: domain. An SPF pass for a Mailchimp-owned envelope domain doesn't align with client.com, so for Mailchimp mail, DKIM is what carries DMARC. That's why both products center on DKIM CNAMEs.

With a custom return-path subdomain on Transactional, the envelope domain becomes a subdomain of the client's domain. If the CNAME target publishes an SPF record that covers the sending IPs, SPF can then align under relaxed alignment. Mailchimp's docs don't spell out SPF alignment for this setup, so treat it as a bonus and rely on DKIM.

On Oct 13, 2026, a live DNS check showed that mandrillapp.com publishes v=spf1 include:spf.mandrillapp.com ~all, and that spf.mandrillapp.com contains only ip4 ranges. A related host, servers.mcsv.net, also publishes an SPF record. Neither appears in Mailchimp's current setup instructions as something to add to a client's record. These are DNS observations only.

Confirming it from a message header

The quickest way to settle "is Mailchimp mail passing?" is a test send to a mailbox you control. Then read the Authentication-Results header the receiving server added (RFC 8601 defines the format). Look for three things:

• dkim=pass with header.d=client.com, or a subdomain of it. That's the aligned DKIM pass DMARC needs.
• spf=pass with smtp.mailfrom showing which envelope domain was checked. It will usually be a Mailchimp domain, unless you set up a Transactional custom return-path.
• dmarc=pass with header.from=client.com.

If DKIM shows a Mailchimp signing domain instead of the client's, authentication isn't finished in the account. Recheck the CNAMEs.

Cleaning up an old Mailchimp include

If a client's apex record still has an old Mailchimp include, such as include:servers.mcsv.net:

1. Confirm DKIM is authenticated in Mailchimp or Transactional, with the CNAMEs resolving.
2. Check the DMARC aggregate reports. Mailchimp traffic should show DKIM passes for the client's domain.
3. Then consider removing the include to free a lookup. Leave it if anything else on that domain still depends on it. When in doubt, ask Mailchimp support for the current position on that specific account.

Check the client's SPF now

Run the free SPF checker →

It walks the include tree, counts DNS lookups against the RFC 7208 limit of 10, names common senders such as Mailchimp, and flags duplicate records and +all or ?all endings, so you can see what an old include is costing.

Founding Partner: $1,999, one time. Find the legacy marketing-tool includes eating lookups across your client base and show each client what changed. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →