SPF for Mailgun
Add include:mailgun.org to your domain's single SPF TXT record, never publish two SPF records. If you send only through Mailgun, the whole record is:
v=spf1 include:mailgun.org ~all
One TXT record, published on the exact host you send from. Mailgun strongly recommends sending from a dedicated SUBDOMAIN (e.g. mg.example.com), so the SPF TXT goes on that subdomain host, not the root apex; the control panel lists it under the domain's Sending/DNS records. The include (include:mailgun.org) is the SAME for the US and EU regions; region only changes the MX and tracking-CNAME targets, not the SPF include. Never publish two SPF records for the same host - merge all senders into one v=spf1 line (a second TXT = permerror). include:mailgun.org counts as ~1-2 of your 10 SPF DNS lookups, so watch the 10-lookup cap if you also stack Google/Microsoft/etc. Mailgun sets its own Return-Path ([email protected] on your subdomain), so SPF authenticates your domain and passes SPF alignment in relaxed mode.
DKIM for Mailgun
Control panel: Send > Sending > Domains > select your domain > the DNS records / Domain settings page shows the exact record to publish. NEW domains default to Automatic Sender Security (ASS), which publishes DKIM as TWO CNAME records with selectors pdk1 and pdk2 (hosts pdk1._domainkey.mg.example.com and pdk2._domainkey.mg.example.com) delegated back to Mailgun; the CNAME targets resemble pdk1._domainkey.<id>.dkim1.mailgun.com. Mailgun then owns 2048-bit keys and auto-rotates them roughly every 120 days with no downtime (two selectors let it stage the new key before cutover). LEGACY / opt-out (manual) domains instead get a SINGLE TXT DKIM record, historically at selector 'smtp' (smtp._domainkey.mg.example.com) holding v=DKIM1; k=rsa; p=<pubkey>. Always copy the EXACT record type, host and value shown in your control panel - do not assume the selector, and do not paste a CNAME value into a TXT record. After publishing, click 'Verify DNS Settings' in the panel and wait for the green check.
Method: mixed · Selector(s): pdk1, pdk2, smtp
ASS (default, CNAME): pdk1._domainkey.mg.example.com CNAME pdk1._domainkey.<generated-id>.dkim1.mailgun.com pdk2._domainkey.mg.example.com CNAME pdk2._domainkey.<generated-id>.dkim1.mailgun.com Legacy/manual (TXT): smtp._domainkey.mg.example.com TXT "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB..."
DMARC for Mailgun
Mailgun does NOT create a DMARC record for you - you publish it yourself at _dmarc.<domain>. Start at p=none with a rua= address, monitor aggregate reports, then move to quarantine and reject. Alignment: because Mailgun signs DKIM with d= your (sub)domain and uses a Return-Path on your subdomain, both DKIM and SPF align in RELAXED mode (the default) when you send from mg.example.com. CAUTION with strict alignment: if you send from a subdomain (mg.example.com) and only publish DMARC at the org level, relaxed alignment covers it, but adkim=s / aspf=s (strict) will FAIL because the subdomain differs from the org domain - keep alignment relaxed unless you also DKIM/SPF-sign from the exact org domain. A subdomain policy inherits the org DMARC unless you set sp= or publish a _dmarc record on the subdomain itself.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r; pct=100"
Common Mailgun mistakes
- TXT-vs-CNAME confusion: new domains default to Automatic Sender Security, which delivers DKIM as pdk1/pdk2 CNAME records - people paste those into TXT records (or expect a p= key) and DKIM never verifies. Publish exactly the type shown.
- Publishing records on the root domain when Mailgun told you to use a subdomain (mg.example.com). The SPF/DKIM/tracking hosts must sit under the subdomain, or the panel stays unverified.
- Forgetting the tracking CNAME (e.g. email.mg.example.com -> mailgun.org, or eu.mailgun.org in the EU): opens, clicks and unsubscribe links silently break even though mail still sends. Do NOT CNAME the whole subdomain - that clobbers your SPF/DKIM/MX.
- Wrong region: EU-region domains use MX mxa.eu.mailgun.org / mxb.eu.mailgun.org and a tracking CNAME target of eu.mailgun.org. Using US records (or the wrong control panel) means the domain never verifies.
- Two SPF records on the same host, or exceeding the 10 DNS-lookup limit once mailgun.org is stacked with other senders - both cause SPF permerror and DMARC SPF failure. Keep one merged v=spf1 line.
- Not clicking 'Verify DNS Settings' after publishing, or checking too soon - DNS can take up to 24-48h to propagate and every required record must show a green check before Mailgun lifts sending limits and removes the 'via mailgun.org' branding.
- Long DKIM TXT keys (legacy/manual mode) getting truncated or mis-split by the DNS provider (must be one logical string / correctly chunked into 255-char segments) - a truncated p= value makes DKIM fail even though the record 'looks' present.
Frequently asked questions
What SPF record do I need for Mailgun?
Add include:mailgun.org to your domain's single SPF TXT record. A domain that sends only through Mailgun would use: v=spf1 include:mailgun.org ~all. One TXT record, published on the exact host you send from. Mailgun strongly recommends sending from a dedicated SUBDOMAIN (e.g. mg.example.com), so the SPF TXT goes on that subdomain host, not the root apex; the control panel lists it under the domain's Sending/DNS records. The include (include:mailgun.org) is the SAME for the US and EU regions; region only changes the MX and tracking-CNAME targets, not the SPF include. Never publish two SPF records for the same host - merge all senders into one v=spf1 line (a second TXT = permerror). include:mailgun.org counts as ~1-2 of your 10 SPF DNS lookups, so watch the 10-lookup cap if you also stack Google/Microsoft/etc. Mailgun sets its own Return-Path ([email protected] on your subdomain), so SPF authenticates your domain and passes SPF alignment in relaxed mode.
How do I set up DKIM for Mailgun?
Control panel: Send > Sending > Domains > select your domain > the DNS records / Domain settings page shows the exact record to publish. NEW domains default to Automatic Sender Security (ASS), which publishes DKIM as TWO CNAME records with selectors pdk1 and pdk2 (hosts pdk1._domainkey.mg.example.com and pdk2._domainkey.mg.example.com) delegated back to Mailgun; the CNAME targets resemble pdk1._domainkey.<id>.dkim1.mailgun.com. Mailgun then owns 2048-bit keys and auto-rotates them roughly every 120 days with no downtime (two selectors let it stage the new key before cutover). LEGACY / opt-out (manual) domains instead get a SINGLE TXT DKIM record, historically at selector 'smtp' (smtp._domainkey.mg.example.com) holding v=DKIM1; k=rsa; p=<pubkey>. Always copy the EXACT record type, host and value shown in your control panel - do not assume the selector, and do not paste a CNAME value into a TXT record. After publishing, click 'Verify DNS Settings' in the panel and wait for the green check.
Do I need DMARC when sending through Mailgun?
Mailgun does NOT create a DMARC record for you - you publish it yourself at _dmarc.<domain>. Start at p=none with a rua= address, monitor aggregate reports, then move to quarantine and reject. Alignment: because Mailgun signs DKIM with d= your (sub)domain and uses a Return-Path on your subdomain, both DKIM and SPF align in RELAXED mode (the default) when you send from mg.example.com. CAUTION with strict alignment: if you send from a subdomain (mg.example.com) and only publish DMARC at the org level, relaxed alignment covers it, but adkim=s / aspf=s (strict) will FAIL because the subdomain differs from the org domain - keep alignment relaxed unless you also DKIM/SPF-sign from the exact org domain. A subdomain policy inherits the org DMARC unless you set sp= or publish a _dmarc record on the subdomain itself.