Set Up Email Domain Authentication

To help your emails reach your recipients' inbox, set up email authentication for your custom domain. Domain authentication proves you're a legitimate sender, and it can improve your email delivery.

This article covers:

• Terms you’ll come across while setting up email domain authentication
• How email domain authentication works
• Two ways to start email domain authentication in Mailchimp
• How to automatically authenticate using Entri (Recommended)
• How to manually find and copy information from Mailchimp and paste it into your domain’s CNAME and TXT records
• How to know if your email domain authentication was successful
• Troubleshooting tips if authentication isn’t working

Definitions

Email domain authentication
The process that email providers use to validate the authenticity of an email sender. This is achieved by adding records to the Domain Name System (DNS).

Email domain verification
A required validation process that Mailchimp uses to make sure you’re sending emails from a legitmate email address that you have access to. This is achieved by clicking a link in a verification email, or entering a verification code into your Mailchimp account. This happens before domain authentication.

DNS record
A Domain Name System (DNS) record is a piece of information that connects a domain name to an IP address. DNS records are stored on DNS servers, which act as an internet directory.

CNAME record
A type of DNS record that links 2 domains. When you authenticate your email domain with Mailchimp, you’ll add 2 CNAME records to your domain's DNS records to prove ownership over your domain.

DKIM
DomainKeys Identified Mail (DKIM) authentication is a sender identification tool that protects email senders and their recipients from spam, forgery, and phishing. This includes CNAME records.

TXT record
A text record (TXT) is a type of DNS record that stores text-based information associated with a domain name. When you authenticate your email domain with Mailchimp, you’ll add 1 TXT record to your domain's DNS records to prove ownership over your domain.

DMARC
Domain-based Message Authentication, Reporting & Conformance (DMARC) is a method of email authentication to show that an email you send is from the real you. This includes TXT records.

Entri
We recommend Entri for automatic email domain authentication. Entri securely connects directly to your DNS provider to automatically configure the required DNS records and domain settings. This eliminates the need for a developer and uses an encrypted login to help ensure that your personal data isn't stored.

To learn more about these terms and the domain authentication process, check out About Email Domain Authentication.

How it works

Email hosting services have security processes to filter malicious senders and spam. If you send emails from an unauthenticated domain, you may experience delivery issues. Domain authentication proves that you're a legitimate sender, and it can improve your email delivery.

Mailchimp now offers automated authentication using Entri to configure the required DNS records.

For manual setup, email domain authentication with Mailchimp still requires you to add 2 CNAME records and 1 TXT record to your domain’s DNS records. To do this manually, find the custom authentication instructions in your Mailchimp account, copy the domain information, and then paste it into your domain’s DNS records.

Authentication can only be added to domains that you or your business own and control. Public email services like Gmail and Yahoo can't be authenticated. To learn more, check out Limitations of Free Email Addresses.

Domain authentication is different from domain verification. With Mailchimp, you’re required to verify your email domain, but this doesn’t impact your email delivery. For best email delivery results, we suggest that you verify and authenticate your email domain.

Verify your email domain

Before you authenticate your email domain, you need to verify it. This is how we make sure you have permission to send email from your email domain.

Authenticate your email domain

You can start the authentication process from several places in your Mailchimp account, including new contextual entry points. The method to complete authentication is now primarily automated via Entri.

Find domain authentication instructions

1. Click your profile icon and choose Account & billing. If you're an account Manager, click Account.
2. Click Domains.
3. Click Start authentication next to the verified email domain you want to work with.
4. In the Select your domain provider section, click the Select your DNS provider drop-down and choose your provider. If your domain provider isn't listed, choose Other.
5. Click Next.

Method 1: Automatic Authentication with Entri (Recommended)

Mailchimp uses Entri to easily authenticate your domain by connecting directly to your DNS provider.

1. To start automatic authentication with Entri, click Continue. Entri will analyze your domain and may detect your DNS provider.
2. You’ll be prompted to log in to your DNS provider. Click Log in.
3. Upon success, a confirmation will display that Records have been created for [your domain].

Method 2: Manual Authentication Steps

If you prefer to authenticate manually, click Or manually authenticate your domain. Select your DNS provider from the dropdown menu. If your provider isn't listed, select Other. Then follow these steps.

1. Click Next.
2. Login to your DNS provider’s website.
3. Create a new DKIM record. To do this, you’ll need to copy and paste 2 CNAME records. Instructions will show the Name (Host) and Value information for CNAME 1 and CNAME 2. Copy and paste this information into your provider's DNS settings.
4. Go back to the authentication instructions on the Domains page of your Mailchimp account and click Next.
5. Create a new DMARC record. To do this, you’ll need one TXT record. Instructions will show the Host value (_dmarc) and the Value (Points To) for the TXT record. Copy and paste this information into your provider's DNS settings.
   
6. Go back to the authentication instructions on the Domains page of your Mailchimp account and click Next.
7. Wait for record validation.

Confirm your email domain authentication

Mailchimp will begin validating your DNS records. Most records update within a few minutes, but this could take up to 48 hours. You’ll receive an email notification once validation is complete.

While authentication is pending, the domain status on the Domains page will show Authentication in progress. In the campaign workflow, the message may state, Your domain is still being authenticated. This could take up to 48 hours.

If authentication is successful, the Authenticated label appears next to the domain. If authentication fails, a message will appear on the Domains page. You will be prompted to Resolve or Restart authentication.

Resources from common domain providers

Here are some authentication resources from common domain providers. If your service isn't listed, search your provider's site for help documents, or contact their support team for additional Support.

Amazon Web Services: Configuring DNS, Resource Record Types

Bluehost Bluerock: Manage DNS Records

Bluehost Legacy: DNS Management

Dreamhost: DNS Overview

GoDaddy: Add a CNAME Record

Google Domains: DNS Basics

Hostgator: Manage DNS records

Hover: Edit DNS Record

IONOS: Configuring CNAME Records

Namecheap: SPF & DKIM

Squarespace: Advanced DNS Settings

Stablehost: How do I get to cpanel?

Wordpress: Adding Custom DNS Records

Siteground: Create CNAME Records

Wix: Adding or updating CNAME Records

Troubleshooting

My CNAME record isn’t updating when I create the domain key.
Depending on your domain provider, you may only need to use part of the information in the Name field. For example, if you enter “k2._domainkey.example.com” and “k2._domainkey.example.com.example.com” is created, update your CNAME record to only include “k2._domainkey”.

My records are all correct, but my domain won’t authenticate in Mailchimp.
If you've entered all records correctly and your authentication isn't working right away, there typically isn't a cause for concern. You may need to wait a bit longer (up to 48 hours) since it can take awhile for servers to recognize your changes.

If you still need additional support, check out your domain provider's help site for tips on troubleshooting DNS records in their service.