Mailchimp domain authentication means adding 2 CNAME records (for DKIM) and 1 TXT record (for DMARC) to your domain's DNS, either automatically through Entri or by copying them in by hand. It's a separate step from domain verification, which only proves you can use the address and, in Mailchimp's own words, doesn't impact your email delivery.
Here's what most people miss. Clicking the link in Mailchimp's verification email isn't authentication. Verification is required before you can send at all; authentication is the part that helps your emails land. Gmail and Yahoo require custom authentication plus a published DMARC record from anyone sending more than 5,000 emails to Gmail or Yahoo addresses in a 24-hour period, and Mailchimp's advice is to authenticate and set up DMARC to stop your emails bouncing.
Verification and authentication side by side
| As of October 2026 | Verification | Authentication |
|---|---|---|
| What it proves | That you can access an address at the domain | To inbox providers that you're a legitimate sender |
| How it's done | Click Verify Domain Access in an email, or enter the code | Add 2 CNAME records and 1 TXT record to your DNS |
| Helps delivery? | No, not on its own | Yes, Mailchimp says it improves delivery |
| Timing | Links and codes expire after seven days | Usually minutes, up to 48 hours |
| Required? | Yes, before you can send | By Gmail and Yahoo above 5,000 emails in 24 hours, and for all Mailchimp Transactional sending to external recipients |
Neither works on a free address. Public email services like Gmail and Yahoo can't be verified or authenticated, because you don't own the domain. You can still send from one, but Mailchimp strongly recommends switching your From address to one on a domain you own, like the one you use for your website. And if you send from a subdomain address, such as [email protected], it has to be verified separately from the main domain.
What the three records do
You don't need to be a DNS expert for this, but it helps to know what you're pasting. Mailchimp's setup asks for exactly three records:
- CNAME 1 and CNAME 2: together these are your DKIM record, the sender identification that protects you and your recipients from spam, forgery and phishing. If you want the background, here's what DKIM does.
- One TXT record with the host _dmarc: this is your DMARC record, which shows that an email you send is from the real you. Here's DMARC in plain English.
Step one: verify your email domain
- Click your profile icon and choose Account & billing, then Domains.
- In the Email Domains section, click Add & Verify Domain.
- Enter an email address at the domain and click Send Verification Email.
- Click Verify Domain Access in the email, or type the code into the pop-up and click Verify.
You only verify a domain once. If the email doesn't arrive, Mailchimp's tips are to allow a couple of hours, resend to another address at the same domain, add [email protected] to your safe senders list, or ask your IT team to allowlist Mailchimp's delivery IPs, because a mail server can drop the first message it gets from Mailchimp. If you've requested verification more than once, use the most recent email, or it won't work.
Step two: authenticate with Entri or by hand
You can start from the Home screen checklist, a delivery warning banner, the prompt in the From field while you're building an email, or from Account & billing, then Domains, then Start authentication next to the verified domain. Choose your DNS provider from the drop-down and click Next.
Entri is the route Mailchimp recommends. It connects straight to your DNS provider with an encrypted login, creates the records for you and confirms that records have been created for your domain. There's no developer needed, and Mailchimp says the encrypted login helps make sure your personal data isn't stored.
If you'd rather do it yourself, click Or manually authenticate your domain and follow these steps:
- Select your DNS provider, or Other if it isn't listed, and click Next.
- Log in to your DNS provider's website.
- Copy the Name (Host) and Value for CNAME 1 and CNAME 2 into your DNS settings, then click Next in Mailchimp.
- Copy the TXT record, with the host _dmarc and its Value, into your DNS settings, then click Next.
- Wait for Mailchimp to validate the records.
How long it takes and how to tell it worked
Most records update within a few minutes, but Mailchimp allows up to 48 hours and emails you when validation's complete. While you wait, the Domains page shows Authentication in progress, and the campaign workflow may tell you your domain is still being authenticated. When it works, an Authenticated label appears next to the domain. If it fails, you'll be prompted to Resolve or Restart authentication.
If every record looks right and it still hasn't gone through, Mailchimp's advice is to give it the full 48 hours, because servers can take a while to recognise the change.
The two traps that break it
The first is the doubled domain. Some DNS providers add your domain to the end of whatever you type in the Name field. Paste k2._domainkey.example.com and you can end up with k2._domainkey.example.com.example.com. If that happens, edit the CNAME so the name is just k2._domainkey.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
The second catches people months later. Mailchimp logs and stores your authentication when you set it up, so changing your CNAME records afterwards can interfere with what Mailchimp has on file. Its fix is to disable authentication on the Domains page first, make your DNS changes, then authenticate again. If you're moving web host or tidying your DNS, put that on the checklist.
My verdict on Mailchimp domain authentication
If you send from your own domain, authenticate it now, even if you're nowhere near 5,000 emails a day. I'd use Entri unless your DNS provider won't connect or your IT team wants to add every record themselves, and I'd never touch those CNAMEs afterwards without switching authentication off first. If your From address is a Gmail or Yahoo one, the fix is a new address on a domain you own, because there's nothing to authenticate.
If your team sends from several domains and wants email and AI tools set up so this sort of job doesn't fall through the cracks, I can help. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and GEO, which is about getting your business seen and cited in AI answers. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
Is verifying a domain in Mailchimp the same as authenticating it?
No. Verification proves you can use the address and doesn't impact delivery. Authentication adds 2 CNAME records and 1 TXT record to your DNS and is what helps your emails reach the inbox.
How long does Mailchimp domain authentication take?
Most records update within a few minutes, but it can take up to 48 hours. Mailchimp emails you when validation is complete.
Can I authenticate a Gmail address in Mailchimp?
No. Public email services like Gmail and Yahoo can't be verified or authenticated. Use an address on a domain you own.
What DNS records does Mailchimp need?
Two CNAME records for DKIM and one TXT record, with the host _dmarc, for DMARC.
Do I need DMARC to send to Gmail?
Gmail and Yahoo require custom authentication and a published DMARC record from anyone sending more than 5,000 emails to their addresses in a 24-hour period.
How long does a Mailchimp verification link last?
Seven days. After that you'll need to request verification again.
