Mailgun SPF and DKIM Setup: Exact DNS Records

Should you use a subdomain or your root domain?

Mailgun recommends separating transactional or marketing traffic on a dedicated domain or subdomain such as mg.yourdomain.com. A subdomain is especially useful when the root domain already receives corporate mail through Microsoft 365 or Google Workspace. Mailgun technically allows the visible From domain to differ from the sending domain, but its sending FAQ recommends matching them for deliverability.

A subdomain is the better choice for three practical reasons:

1. Traffic separation. Bulk and transactional traffic builds a distinct subdomain sending history, though mailbox providers may still connect related domain signals.
2. Fewer record conflicts. A root domain often already has SPF and MX records for Microsoft 365 or Google Workspace, which an MX record lookup will show you. A fresh subdomain lets you publish Mailgun's sending records without changing the root domain's inbound mail routing.
3. Easier multi-service management. If you run email for clients as an MSP, a mg. subdomain per client domain keeps each platform's records isolated and auditable.

How do you add the Mailgun SPF record?

1. Open the Mailgun domain list

Log in to the Mailgun control panel, expand Sending in the left navigation, and click Domains.

2. Add the sending domain

Click Add New Domain, enter your sending domain (for example mg.yourdomain.com), and click Add Domain.

3. Publish the SPF record

Mailgun shows the DNS records to publish. In your DNS host, create the SPF record on the sending domain:

Type:  TXT
Host:  mg.yourdomain.com
Value: v=spf1 include:mailgun.org ~all

If you are setting up the root domain and it already has an SPF record, do not create a second one. A hostname can only have one. Insert include:mailgun.org after v=spf1 and before the existing terminal all mechanism, preserving that mechanism's qualifier (-, ~, ?, or +). Mailgun's example uses ~all:

v=spf1 ip4:1.2.3.4 include:smtp.domain.tld include:mailgun.org ~all

Keep the merged record under SPF's limit of 10 DNS lookups, or receivers will return a permerror. You can confirm the record resolves and stays within the limit with Palisade's free SPF checker.

4. Confirm the public record

Query the sending hostname after DNS propagates, then return to Mailgun's DNS records tab and click Check status. The result should expose one SPF policy containing include:mailgun.org.

How do you add the Mailgun DKIM record?

First check whether Automatic Sender Security is enabled for the Mailgun domain. With manual DKIM, Mailgun generates the key pair, keeps the private key, and gives you a TXT record containing the public key. The selector varies by domain, so always copy the exact hostname and value from the control panel:

Type:  TXT
Host:  mx._domainkey.mg.yourdomain.com
Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4... (copy the full key from Mailgun)

With Automatic Sender Security, publish both CNAME records shown by Mailgun instead of copying the manual TXT example. The CNAME hosts resemble pdk1._domainkey.mg.yourdomain.com and pdk2._domainkey.mg.yourdomain.com; their targets are account-specific Mailgun hostnames. The two records let Mailgun rotate the hosted public keys without another DNS edit.

Two details from Mailgun's DKIM documentation matter during verification:

• Key length. Mailgun supports 1024-bit and 2048-bit keys. 2048 is stronger, but the record value is significantly longer, which some DNS panels handle awkwardly.
• Rotation interval. Automatic Sender Security rotates keys every 120 days by default, and Mailgun allows the interval to be adjusted.

How do you verify your domain in the Mailgun dashboard?

Once the records are live, Mailgun's system checks them periodically and emails you when the domain flips to Verified. Propagation can take 24 to 48 hours, though it is usually much faster. To check manually:

1. In the control panel, expand Sending and click Domain settings.
2. Open the DNS records tab.
3. Pick the right domain in the Domain drop-down at the top right.
4. Click Check status (Mailgun's setup guide calls the same control the Check DNS Records Now button on the DNS Settings page).

How does the setup affect DMARC alignment?

DMARC requires SPF or DKIM to pass with an authenticated domain aligned to the visible From domain. RFC 9989 defines relaxed alignment as sharing the same organizational domain and strict alignment as an exact domain match.

Here is how a Mailgun subdomain setup plays out when you send as you@yourdomain.com through mg.yourdomain.com:

• SPF: DMARC evaluates the SPF-authenticated MAIL FROM identity, often visible as the Return-Path. If it is mg.yourdomain.com and the visible From domain is yourdomain.com, the two align in relaxed mode but not strict mode.
• DKIM: DMARC evaluates the d= domain on a passing DKIM signature. A d=mg.yourdomain.com signature aligns with a From domain of yourdomain.com in relaxed mode but not strict mode. If Mailgun signs with d=yourdomain.com, it can align in either mode.

What are common Mailgun SPF and DKIM setup problems?

Why does Mailgun still show the domain as Unverified?

An Unverified Mailgun domain usually means DNS is still propagating or a hostname or value was copied incorrectly. Verify each hostname with dig or an external lookup, then click Check status. Records must match Mailgun's values exactly.

Why is the Mailgun SPF record missing?

A missing Mailgun SPF record often means it was published at the wrong hostname. The SPF record belongs on the configured sending domain: mg.yourdomain.com for a Mailgun mg. subdomain, or the root only when the root itself is the Mailgun sending domain. Some DNS panels append the zone name automatically, so entering the full hostname can accidentally create mg.yourdomain.com.yourdomain.com.

Why does Mailgun report more than one SPF record?

Multiple SPF records at one hostname do not combine their authorizations. RFC 7208 requires SPF to return PermError when DNS yields more than one SPF record, so merge Mailgun's include with the other authorized mechanisms in one policy.

Why do Mailgun's DKIM CNAMEs conflict with existing records?

Mailgun's DKIM CNAMEs cannot share their exact pdk1._domainkey or pdk2._domainkey hostname with other DNS data. Remove the conflicting record only after confirming it is obsolete, or configure Mailgun with different selectors; do not delete an active key used by another sender.

Why does DMARC fail on Mailgun's sandbox domain?

Mailgun's shared sandbox domain is for testing with authorized recipients, not for authenticating your own From domain. Move real traffic to a verified custom domain and then check whether its SPF or DKIM identity aligns with the visible From domain.

Why can Mailgun SPF pass while DKIM fails alignment?

A Mailgun message can pass SPF while DKIM remains misaligned because DMARC evaluates the two authenticated domains separately. Check the message's DKIM d= value, the MAIL FROM or Return-Path domain, and the visible From domain; our guide to why DKIM signatures fail alignment covers the DKIM branch.