Mandrill SPF and DKIM setup

What you are setting up

Mandrill is Mailchimp Transactional, the API and SMTP product for receipts, password resets, and other one-to-one mail. It is a separate account and a separate set of DNS records from the Mailchimp marketing product; if you send newsletters through Mailchimp too, follow the Mailchimp guide for that side as well. For Mandrill you verify that you own the domain, then publish two DKIM CNAME records and a DMARC record. There is no SPF step in the official setup, and the reason is the gotcha below.

Publish SPF and DKIM

In Mandrill, go to Settings > Domains and add your sending domain. Mandrill first asks you to prove ownership: either click the link in the verification email it sends to an address on the domain, or publish the TXT record it shows you (a value beginning mandrill_verify. followed by a key unique to your account) and click Test DNS Settings. Verification only proves ownership; the domain still needs DKIM and DMARC before Mandrill treats it as authenticated.

Then publish the two DKIM records. They are CNAMEs, not TXT records:

Type:  CNAME   (DKIM, selector mte1)
Host:  mte1._domainkey
Value: dkim1.mandrillapp.com

Type:  CNAME   (DKIM, selector mte2)
Host:  mte2._domainkey
Value: dkim2.mandrillapp.com

Two selectors let Mandrill rotate the signing key on its side without you touching DNS again. Publish both; a single CNAME is a half-finished setup. Click Test DNS Settings once more and the domain should show DKIM as configured (propagation can take up to 48 hours). If your DNS host appends the domain automatically, enter only mte1._domainkey, not the full hostname.

You will notice there is no SPF include in that list. Mandrill's current documentation does not ask you to add one, and older guides that mention an include: for Mandrill are describing a setup the docs have since replaced. Your existing SPF record stays as it is for your other senders.

Add DMARC

Mandrill requires a DMARC record before it counts the domain as authenticated. The minimum it accepts is v=DMARC1; p=none; add a reporting address so you actually see the reports:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Without DMARC, Mandrill rewrites the From address on your mail to a mandrillapp.com subdomain, so your recipients see Mandrill's domain instead of yours.

The Mandrill gotcha

DKIM carries your DMARC pass, and the CNAMEs replaced the old TXT key. Mandrill used to hand out a mandrill._domainkey TXT record and an SPF include, and plenty of third-party tutorials still quote them. Since March 2024 the official setup is the mte1 and mte2 CNAMEs plus DMARC. With no SPF include, the mail passes SPF on Mandrill's own bounce domain, which does not align with yours, so alignment comes from the DKIM signature alone. That is fine for DMARC, but it means a broken CNAME is a broken source, with no SPF fallback.

If you want the bounce address on your own domain too, add a custom return-path domain: create a CNAME from a subdomain such as mail.yourdomain.com to mandrillapp.com, then add that subdomain under Settings > Tracking & Return Path Domains and click Test DNS Settings. It must be a subdomain, not the apex, and a return-path domain can belong to only one Mandrill account. You can also set it per message with the return_path_domain API parameter or the X-MC-ReturnPathDomain SMTP header.

Confirm it worked

• Check the domain in Mandrill. Under Settings > Domains the domain should show as verified with DKIM and DMARC in place after Test DNS Settings.
• Send a test and read the headers. Send through Mandrill, open the message, and confirm the DKIM signature shows d=yourdomain.com with a s=mte1 or s=mte2 selector and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Mandrill should appear as a DKIM-aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.