Mailchimp emails going to spam: authenticate the sending domain

Start with the sending domain. Mailchimp asks you to verify a domain, which proves you control the address and lets you send from it, and separately to authenticate it, which publishes DKIM and SPF records so receivers see the mail as coming from your domain rather than from Mailchimp's. Plenty of accounts do the first and not the second, and then the campaign fails DMARC alignment and gets filtered — especially by Microsoft 365 and by any domain publishing p=quarantine or p=reject.

Where it lives: the Domains page in your Mailchimp account (under the website and domain settings). Mailchimp shows the exact DNS values to publish — historically a k1._domainkey CNAME pointing at Mailchimp's DKIM host plus an SPF include for its sending servers. Copy them from that page, not from a blog post, because the hostnames change and a stale value silently breaks signing.

Then prove it worked with a real message: send a campaign to a mailbox you control, open the raw headers, and look for dkim=pass with header.i= on your domain and dmarc=pass with header.from= on your domain. Mailchimp's own green status only tells you the records resolve.

How the other platforms handle the same step

The pattern is identical everywhere: a DKIM signature on your domain, and a return path on a subdomain you own so SPF authenticates you rather than the platform. Without the return-path piece, only DKIM can carry DMARC alignment — which is fine until a forwarder breaks the signature.

The other four causes, in order of frequency

1. An unengaged list. Complaints and ignored mail come from people who forgot they subscribed. Mailchimp marks hard-bounced and complaining contacts as Cleaned automatically, and those cannot be re-added by re-import. Segment by recent engagement and stop sending to the long tail; Google's published threshold for bulk senders is a user-reported spam rate below 0.3%, and an old list is the fastest way past it.
2. Inconsistent volume. Nothing for six weeks, then 40,000 in an hour, reads as a compromised account. Spread large sends and keep a baseline.
3. Content mechanics. Image-only campaigns with no plain-text alternative, a shortened-link domain with no reputation, or a single giant image wrapped in a link. None of these are "spam words"; they are structural signals.
4. Missing bulk-sender requirements. For 5,000+ messages a day to Gmail you need SPF, DKIM, aligned DMARC and a one-click unsubscribe header (RFC 8058). Mailchimp adds the unsubscribe mechanics for you; DMARC is yours to publish.

Fix it in this order

1. Authenticate the sending domain in Mailchimp and confirm alignment from real headers.
2. Publish DMARC at p=none with a rua= address, read a week of reports, then tighten to quarantine.
3. Build an engaged segment — opened or clicked in the last 90 days — and send only to it for two or three campaigns while rates recover.
4. Check the Gmail spam rate in Postmaster Tools for the sending domain. If it is above 0.1%, keep narrowing the audience.
5. Check the domain against blocklists. Note that some lookup pages still report dead lists; SORBS shut down in June 2024, while Validity's Heatwave blocklist launched on 3 September 2026 and is genuinely current.
6. Run a seed placement test per provider with the real campaign, before and after each change, so you can tell which fix moved the needle.

What not to do

• Do not re-import cleaned or unsubscribed contacts. Mailchimp will not re-add them, and on other platforms you are manufacturing complaints.
• Do not send a "we miss you" blast to a two-year-old inactive list from your main domain. If you must, batch it small and expect complaints.
• Do not authenticate your corporate domain for marketing and then also run cold outreach on it. Use a separate subdomain for each stream.
• Do not judge the fix by open rate. Apple Mail Privacy Protection and image proxies inflate opens; use clicks, replies and seed placement.
• Do not move to a different platform to escape the problem. An unauthenticated domain and a tired list behave the same way everywhere.

MailPilot does not integrate with Mailchimp, and we are not going to imply otherwise. What it covers is the layer underneath: SPF, DKIM and DMARC checks on the sending domain, warm-up for mailboxes connected over OAuth (Gmail, Outlook) or SMTP and IMAP (SendGrid, Amazon SES, Mailgun, Postmark, custom SMTP), real per-provider inbox placement measurement, and daily per-mailbox reputation — the folder-level evidence a campaign dashboard cannot give you.