Known quirk
Mandrill's SPF may not line up with your domain
We didn't find a custom return path for Mandrill, so its SPF won't line up with your domain. That's normal for Mandrill. Your mail is still authenticated, because Mandrill signs it with your DKIM key.
What this means for you
- Nothing to change while DKIM keeps signing.
- In DMARC reports, Mandrill mail shows SPF not aligned and DKIM aligned. That's expected.
- A custom return-path domain in Mandrill, on a subdomain such as mail, lines SPF up too.
If Mandrill mail stops signing with DKIM, your report shows it as a gap.
Why it happens
SPF checks the hidden bounce address, not the one people see. Mandrill's bounce address is on its own domain unless you customize it, so SPF can pass without matching yours. DMARC only needs SPF or DKIM to match, and DKIM does.
Technical detail
Mailchimp Transactional's return-path address points to mandrillapp.com by default, so SPF isn't aligned with the From domain (RFC 7489 section 3.1.2). A custom return-path domain must be a subdomain, such as mail.example.com. DMARC passes through the aligned DKIM signature (mte1/mte2._domainkey CNAMEs).
mandrill.spf_default_return_path
Sources
- Mailchimp Transactional: Authentication and Delivery
- RFC 7489 (DMARC), section 3.1.2: SPF-authenticated identifiers
Reviewed by healthcheck.email on 2026-10-09.