Set up Mailchimp domain authentication on Namecheap

Three records, and one surprise: Mailchimp doesn't ask for an SPF record. What it wants is two CNAME records for DKIM and one TXT record for DMARC — "your domain's DNS records need to be updated with 2 CNAME records (for DKIM) and 1 TXT record (for DMARC)", in its own words. You add them in Domain List → Manage → Advanced DNS → Add new record.

The two DKIM values are generated for your account. Mailchimp shows them on screen; nobody can publish them in advance, and any tutorial handing you a ready-made pair is guessing. What this guide gives you is where to click, what goes in which field, and the one Namecheap behaviour that breaks this setup more than anything else.

These records let receiving mail servers check that a message claiming to be from you really is from you. They do not guarantee your email reaches the inbox — your content and your sending reputation matter at least as much — but without them, anyone can send email in your name.

What we don't do: we never touch your DNS zone. This guide tells you what to type and where. You're the one who saves it, in your own account, with your own credentials.

Before anything else: can you see the Host Records section?

Namecheap is unusually clear about this, and it's the most common reason a Mailchimp setup silently never verifies. The Advanced DNS tab only manages your records if your domain uses Namecheap's own nameservers: "The Host Records section is available only for the domains using Namecheap BasicDNS, FreeDNS or PremiumDNS."

And if it isn't: "If you see no option to manage the DNS records in the Advanced DNS section, your domain is pointed to a third-party nameservers OR our hosting nameservers… Hence, you need to add/update the DNS records at your current DNS provider or in your cPanel."

So if the section is missing or looks empty, don't hunt for a hidden button. Your DNS lives elsewhere, and that's where these records belong. The values don't change — only the panel does.

One warning about Mailchimp's own help link, because it will send you to the wrong place. In its list of resources by provider, Mailchimp links "Namecheap: SPF & DKIM" to Namecheap's article about the cPanel Email Deliverability tool — which is for Namecheap hosting customers. If you're a typical Namecheap domain owner, that isn't your panel. You want Advanced DNS, described below.

The records to copy and paste

1. DKIM — the signature on your messages

Two CNAME records, both generated for your account.

…and the same again for the second pair.

What you must replace: both, entirely. Mailchimp's instruction is to "copy and paste 2 CNAME records. Instructions will show the Name (Host) and Value information for CNAME 1 and CNAME 2." Take them from your screen, not from a guide.

🔴 The trap that catches nearly everyone here, and both vendors describe it independently.

Namecheap: "Namecheap DNS system automatically adds the domain name to the values submitted during record creation. Please make sure that your domain name is not duplicated in the values." And, more bluntly: "The domain name itself should not be included in the Host field. It means that if you need to add the record for something._domainkey.yourdomain.tld, only something._domainkey is to be added as a Host value (even if your service provider asked you to add the domain itself as well). This is a system requirement."

Mailchimp, from the other side: "Depending on your domain provider, you may only need to use part of the information in the Name field. For example, if you enter k2._domainkey.example.com and k2._domainkey.example.com.example.com is created, update your CNAME record to only include k2._domainkey."

They are describing the same failure from two sides. Mailchimp displays a full hostname; Namecheap appends your domain to whatever you type. Strip your domain off before pasting.

2. SPF — the record Mailchimp doesn't want

There is no Mailchimp SPF record to add. Not because SPF doesn't matter, but because Mailchimp handles it on its own side: "SPF is already set up on all of our sending IP domain names, so there's nothing you'll need to do to set that up."

What that means in practice: Mailchimp sends using its own envelope domain — one of mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net — and SPF is checked against that, not against your domain. Your Mailchimp campaigns pass DMARC through DKIM alignment, which is exactly what the two CNAME records above are for.

So don't go looking for an include: to add. Mailchimp publishes none, and inventing one does nothing.

If you already have an SPF record for your mailboxes, leave it alone. It's still doing its job for Google Workspace, Microsoft 365, or whoever hosts your email:

⚠️ One SPF record per domain, if you have one at all. Two v=spf1 lines mean no SPF at all — including for the mailboxes that worked yesterday. When you add a sending tool that does need an include, you edit the existing line.

Careful with Namecheap's SPF example. Its generic TXT article illustrates SPF with v=spf1 a ~all, which authorises only the IP your domain's A record points to — usually a website, not a mail server. It's a teaching example, not a value to copy.

3. DMARC — the instruction you give to inboxes

What you must replace: YOU@YOUR-DOMAIN.com with an address you actually read. That's where your reports land, and a DMARC record without a rua= is a report you'll never see.

Mailchimp will show you a value for this record too. Compare it with the one above: if the one it offers has no rua=, add yours. You gain reports and lose nothing.

Why p=none first. It means "watch and tell me". Nobody gets blocked, nothing changes for your recipients, and you start receiving a list of everything sending in your name — including the tools you'd forgotten about. You watch for two to four weeks, confirm every legitimate sender is recognised, and only then tighten one notch to p=quarantine, then p=reject.

⚠️ Do not copy Namecheap's own DMARC example, and this is worth two minutes because it catches conscientious people following their registrar's documentation. Namecheap's knowledge base calls this "a very basic DMARC record":

v=DMARC1;p=reject;sp=quarantine;pct=100;rua=mailto:dmarcreports@example.com

Two problems. It starts at p=reject — the strictest possible policy, published before you've read a single report, which silently kills any legitimate sender you'd forgotten. And it uses pct=, a tag removed from the DMARC standard by RFC 9989, published in May 2026. Servers following the current standard ignore it, so pct=100 does nothing and a smaller number gives you no gentle rollout either.

There is nothing "very basic" about that record. Start at p=none.

⚠️ One DMARC record per domain too. If you already have one, you edit it.

The click path

1. Sign in to Namecheap and open your Domain List.
2. Click Manage next to your domain.
3. Open the Advanced DNS tab.
4. In the Host Records section, click Add new record.
5. Pick the type — CNAME Record for the two DKIM records, TXT Record for DMARC.
6. Fill in Host, then Value, then TTL.
7. Click Save all changes.

In Mailchimp, to get your values: click your profile icon → Account & billing (or Account if you're an account Manager) → the Domains tab → Start authentication next to your verified domain. Then choose your DNS provider from the dropdown.

Two things about that screen. Mailchimp offers an automatic setup through Entri, which logs into your DNS provider and writes the records for you. If your provider is detected, it's the fastest route. If not, click Or manually authenticate your domain and use the click path above.

Also: "Domain authentication is different from domain verification." Verifying proves you control the mailbox; authenticating is what this page is about. Doing the first doesn't do the second.

On TTL: Namecheap's default is 30 minutes, and its advice is to "select it from the drop-down or just leave it 'Automatic'." Automatic is right for all three records.

The 3 mistakes we see most often here

1. Pasting the full hostname into the Host field

Mailchimp shows you something that looks like a complete address. Namecheap appends your domain to whatever you type. Put the two together and you publish k2._domainkey.yourdomain.com.yourdomain.com — a record at an address nothing will ever query.

It's the single most documented failure of this combination: both companies warn about it, in their own words, on their own help pages, and people still hit it because the warning lives in a paragraph you read after the setup fails.

How you spot it: Mailchimp's status stays on Authentication in progress, or you get "Your domain is still being authenticated" long past the point where it should have resolved. Look at your Advanced DNS list: if a Host ends in your domain name, that's it.

The fix: shorten the Host to the prefix only. Then wait 30 minutes and click verify again.

2. Adding an SPF record for Mailchimp

You know SPF matters, Mailchimp never mentions it, so you go looking — and end up either inventing an include: that doesn't exist, or creating a second v=spf1 line "just for Mailchimp". The second one is actively harmful: two SPF records mean no SPF at all, and now your normal mailboxes fail too.

How you spot it: a scan reports multiple SPF records, or SPF in permerror while each individual line looks fine.

The fix: delete the extra line. Mailchimp is aligned through DKIM, and that's by design, not an oversight.

3. Reading "Verified" and stopping there

Mailchimp verifies your email address by sending you a code — that's domain verification, and it's required before you can send. It does nothing for authentication. The green state you actually want is Authenticated, and it only appears once the CNAMEs resolve.

There's a related consequence worth knowing if you send from a free address. Following the Google and Yahoo sender requirements that took effect in February 2024, Mailchimp rewrites the sending domain for free-mail From addresses: "If you use a free domain that could have delivery issues, we'll automatically make a small change to your email address each time you send an email… We'll use either the send.mailchimpapp.com or mail.mailchimpapp.com subdomains as the From domain." So you@yahoo.com goes out as you.yahoo.com@send.mailchimpapp.com. Replies still reach you — but your campaigns are no longer branded with your own domain.

Mailchimp doesn't block those addresses; it rewrites them. The way out is the same either way: send from a domain you own and authenticate it.

How you spot it: your campaigns show a mailchimpapp.com sender, or your Domains page shows the domain verified but not authenticated.

The fix: use an address on your own domain, then run the three records above.

⚠️ And don't mix up two opposite traps. Typing the full hostname in Namecheap's Host field creates a duplicated domain and the fix is to shorten it. At some other hosts (OVH, Gandi), the symmetrical trap sits on a CNAME target, where the fix is to add a trailing dot. Same look, opposite fixes.

How long before it takes effect

• In Namecheap: saved as soon as you click Save all changes.
• On the internet: Namecheap's figure is "normally, it takes 30 minutes for newly created host records to take effect" — faster than most registrars.
• The old value can stay cached for as long as the TTL you had set before the change — 30 minutes on Namecheap's default.
• For Mailchimp's check: "Most records update within a few minutes, but this could take up to 48 hours." Wait half an hour before clicking verify, then wait again.
• For DMARC reports: the first ones arrive 24 to 72 hours after you publish, then roughly once a day.

Next steps

• How to set up SPF, DKIM and DMARC on Namecheap
• How to set up SPF, DKIM and DMARC on GoDaddy
• How to move your DMARC policy to p=reject safely
• My emails go to spam even though SPF, DKIM and DMARC pass