Sending email through Mandrill (Mailchimp Transactional) does not authenticate your domain on its own. Until you publish SPF, DKIM, and DMARC, receiving servers like Gmail, Outlook, and Yahoo can't confirm your mail is really from you — so it lands in spam, or since the 2024 Gmail/Yahoo bulk-sender rules, gets rejected outright. This guide covers the complete setup, in order.

What you'll set up

SPF — authorizes Mandrill (Mailchimp Transactional)'s servers to send as your domain
DKIM — cryptographically signs every message so it can't be forged
DMARC — tells receivers what to do if SPF or DKIM fail, and sends you reports

Step 1: Add SPF

SPF tells receiving servers that Mandrill (Mailchimp Transactional) is authorized to send email for your domain. Add this TXT record at your root domain:

Name:  @  (your domain, e.g. yourdomain.com) Type:  TXT Value: v=spf1 include:spf.mandrillapp.com ~all

If you already send through another provider (Google Workspace, Microsoft 365, a CRM), you must have one SPF record that includes all of them, for example:

v=spf1 include:spf.mandrillapp.com include:_spf.google.com -all

Once you're confident every sending service is listed, switch the trailing ~all to -all (hardfail) for stronger protection. Watch the 10-DNS-lookup limit — too many includes causes an SPF permerror.

Tip: Mandrill (Mailchimp Transactional) occasionally updates its sending infrastructure — confirm the exact include value in your Mandrill (Mailchimp Transactional) dashboard before publishing.

Step 2: Enable and publish DKIM

DKIM adds a cryptographic signature to every message. Mandrill (Mailchimp Transactional) generates a unique key pair and gives you a DNS record to publish the public half.

Open Mandrill (Mailchimp Transactional)'s domain / sender authentication settings
Enable DKIM (or "authenticate domain")
Copy the DKIM record Mandrill (Mailchimp Transactional) shows you — usually at a selector like mandrill._domainkey
Add it to your DNS provider exactly as shown (TXT or CNAME)
Return to Mandrill (Mailchimp Transactional) and click verify once DNS has propagated

DKIM won't activate until Mandrill (Mailchimp Transactional) confirms the record is live, so allow 15–60 minutes for propagation before verifying.

Step 3: Add DMARC

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both. Start in monitor-only mode so you can review reports before enforcing:

Name:  _dmarc Type:  TXT Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Replace the rua address with a mailbox you can read — that's where daily aggregate reports go. Or point it at a free EmailHealth DMARC inbox and we'll parse the XML into a readable per-sender breakdown.

Step 4: Verify it's all passing

After the records propagate, send a test through Mandrill (Mailchimp Transactional) and confirm authentication:

SPF: the receiving server shows spf=pass
DKIM: the raw headers show dkim=pass with your domain
DMARC: dmarc=pass once SPF or DKIM aligns to your domain

The fastest way is to run a free EmailHealth domain check — it confirms all three at once and scores your overall deliverability.

Mandrill (Mailchimp Transactional)-specific gotchas

Mandrill's DKIM record is published at mandrill._domainkey as a TXT record — the exact value is shown in your Mandrill domain settings.
You must verify and authenticate the sending domain inside Mandrill (Settings → Domains) after the DNS records propagate.

Step 5: Progress to enforcement

After 1–2 weeks at p=none with clean reports, tighten your DMARC policy: move to p=quarantine; pct=25, increase gradually, then p=rejectonce no legitimate mail is being caught. That's when spoofing of your domain actually stops.

How to Set Up SPF, DKIM & DMARC for Mandrill (Mailchimp Transactional)