SPF record for Mailgun

Mailgun sends application mail over its API or SMTP. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Put this on the sending domain, and make the sending domain a subdomain. Mailgun recommends mg.example.com. Its setup puts MX records on the sending domain for inbound routing and bounce handling, and you can't give those to your root domain without breaking your normal mail.

The include is:

Count your lookups after any change, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF. Our free SPF checker follows every include and gives you the count. It also shows whether Mailgun needs the include on the domain you check.

DKIM

Mailgun publishes a TXT DKIM record under a selector shown in the domain's DNS records panel. The selector differs between older and newer accounts, so read it off the panel. The record goes under the domain Mailgun sends from, such as mg.example.com.

Return path and SPF alignment

Mailgun also needs MX records on the subdomain to process bounces:

Because the envelope sender is then on mg.example.com, SPF aligns with a From address at example.com under relaxed matching.

DMARC alignment with Mailgun

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Tracking links use a CNAME on the sending subdomain. Skipping it leaves click tracking pointing at Mailgun's domain, which does not affect DMARC and does affect how the mail looks.
• Mailgun's EU and US regions are separate. A domain added in one is not visible in the other, and the DNS records differ.
• Sending from the root domain works and costs you the ability to keep the two reputations apart. Use the subdomain.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Mailgun to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Mailgun's own documentation, at Mailgun documentation. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.