[ Sending-service guides ]

Authenticate email sent through Mandrill: configuration and verification

Authenticate Mandrill as Mailchimp Transactional, reconcile current CNAME guidance with older TXT examples, and verify the real application route rather than a Mailchimp Marketing campaign.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Use current account-issued CNAMEs and resolve conflicting legacy examples.
  • Separate ownership, DNS validation and actual message authentication.
  • Diagnose submission and queue state before changing DNS.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Diagnose submission and queue state before changing DNS.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Reconcile records with the account

The detailed CNAME guide and older TXT tutorial text must not be merged blindly.

Next steps

  1. Capture account-displayed instructions.
  2. Preserve existing DNS before edits.
  3. Record all received authentication identities.

CISO / SecOps

Require proof beyond green checks

Ownership, DNS validation, delivery and DMARC alignment are distinct evidence layers.

Next steps

  1. Keep credentials out of test evidence.
  2. Retain the original-message acceptance table.
  3. Require SME approval before production sign-off.

Founder / Non-technical

Protect the application event

Transactional mail can carry time-sensitive account or order information, so the sending route needs an accountable business owner.

Next steps

  1. Identify the production integration.
  2. Choose a harmless acceptance event.
  3. Agree on a workflow-specific pause and recovery plan.

[ FAQs ]

Frequently asked questions

Does this apply to Mailchimp Marketing campaigns?

No. This article is scoped to the Transactional API or SMTP route; identify the actual sending product before reusing its checklist.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I combine the old TXT example and current CNAME instructions?

No. Resolve the documentation mismatch against your account and support before making a migration or removal decision.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What does a successful domain API response prove?

It supplies provider-side configuration evidence. Preserve its relevant fields, then test a real message from the intended application.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Is publishing p=none a DMARC pass?

No. A policy is not a message result; the received message still needs an aligned passing authentication method.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Should I add a generic SPF include at the visible From domain?

Not without checking the actual envelope domain and current route requirements. An unrelated SPF edit cannot manufacture alignment.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Why investigate queued_reason before editing DNS?

A queue can reflect capacity or account state. Diagnose the returned status so a transport or quota problem is not mistaken for authentication failure.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

Can an open or click approve the authentication change?

No. Retain trusted receiver results and the original message, not just engagement data.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

What remains required before publication?

Current account applicability, reconciliation of conflicting setup examples, the exact-route original received-message identity table and human SME approval.

Mailchimp Developer product index Send Your First Transactional Email Authentication and Delivery Add a sender domain Outbound Email SMTP Integration Activity and Reports RFC 7208 SPF RFC 6376 DKIM RFC 9989 DMARC

[ Sources ]

Sources

  1. Mailchimp Developer product index

    Sections Transactional formerly Mandrill28–35

  2. Send Your First Transactional Email

    Sections Configure DNS:two-CNAME and conflicting legacyTXT paragraph70

  3. Authentication and Delivery

    Sections DKIM66–73; ownership78–97; DMARC; custom Return-Path133–144

  4. Add a sender domain

    Sections Response fields dkim,dkim2,dmarc,verified_at,verify_txt_key

  5. Outbound Email

    Sections Backlog45–51; Troubleshooting/API logs

  6. SMTP Integration

    Sections Credentials36–39; troubleshooting65–70; host/password88–95

  7. Activity and Reports

    Sections Content storage44–50; data storage; tracking

  8. RFC 7208 SPF

    Sections §3.2; 3.3; 4.6.4

  9. RFC 6376 DKIM

    Sections §3.5; 3.6.2; 6.1

  10. RFC 9989 DMARC

    Sections §4.4; 4.7; 4.10; 5

[ Glossary ]

Glossary

Mailchimp Transactional
The event-driven API and SMTP email service formerly called Mandrill.
Sending Defaults
Account-level message settings that must be compared with effective application overrides.
Ownership verification
A provider check that the sender controls the domain, distinct from received-message authentication.
Return-path domain
The SMTP envelope domain used for bounce handling and SPF evaluation.
queued_reason
Provider response detail used to distinguish queue causes from authentication failures.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base