Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools

What it means

Tools like Mailchimp, Brevo, SendGrid, Mailgun, Amazon SES or HubSpot send emails on your behalf. Out of the box, they often:

• sign the email with DKIM for their domain, not yours;
• use their domain in the hidden envelope sender (Return-Path), so SPF is checked on their domain.

Both checks pass, but for the wrong domain. DMARC needs at least one of them to match the domain in your From address. This match is called alignment. Without it, DMARC fails.

Why it matters

• Gmail and Yahoo require bulk senders to pass DMARC with their own domain.
• When your DMARC policy is quarantine or reject, unauthenticated newsletters go to spam or are refused.
• Your reputation builds on your own domain instead of being shared with every customer of the tool.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. Look at the DKIM line (which domain signed?) and the SPF line (which domain was checked?). DMARC should pass.
• Use the Domain scanner: type your domain at /domain-scanner to check your SPF and DMARC records.

How to fix it

1. Find the authentication page

Every tool has one, under names like "Domain authentication", "Sender authentication", "Domains" or "Verified domains". Add your domain there.

2. Add the DKIM records

The tool gives you one to three records, usually CNAME (sometimes TXT) under _domainkey, for example:

s1._domainkey.yourdomain.com  CNAME  (value given by the tool)

Copy names and values exactly. Some DNS providers add your domain automatically to the name: if so, type only s1._domainkey.

3. Add the custom return path

Many tools also offer a "custom return path", "bounce domain" or "MAIL FROM domain". It is a subdomain of yours, often a CNAME:

bounces.yourdomain.com  CNAME  (value given by the tool)

SPF is then checked on your subdomain, which aligns with your domain. This gives you a second aligned check, useful if DKIM ever breaks.

4. SPF include: only if asked

Some tools ask you to add an include: to your main SPF record; others do not need it once the return path is set up. Follow their instructions, and keep a single SPF line under 10 DNS lookups.

5. Verify in the tool

Click "Verify" or "Authenticate" once the records are visible. DNS changes can take from a few minutes to 48 hours.

6. Use your domain in the From address

Send from an address on the authenticated domain, such as news@yourdomain.com, never from a free address like Gmail or Yahoo.

Check that it is fixed

Send a campaign or test email from the tool to your Delivmail test address. DKIM should show d=yourdomain.com and DMARC should pass. Repeat for each tool you use. With Delivmail DMARC monitoring in the paid dashboard, the daily reports show any sending source that is still not aligned.