SPF and DKIM by provider

SPF record for Mailgun

Last updated 2026-08-26

Mailgun sends application mail over its API or SMTP. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

The SPF record

Add one mechanism to the SPF record on your sending domain:

In a complete record, alongside Google Workspace, that looks like:

Put this on the sending domain, and make the sending domain a subdomain. Mailgun's own recommendation is mg.example.com, and the reason is practical: the setup wants MX records on the sending domain for inbound routing and bounce handling, and you cannot give those to your root domain without breaking your normal mail.

Then count your lookups. SPF allows ten DNS-querying mechanisms across the entire nested chain, and the eleventh turns the record into a permerror that authorises nothing. The record still reads correctly to a human while every check fails. Run the domain through the SPF checker after every change, because the number moves when your providers change their own records, not just when you change yours.

DKIM

Mailgun publishes a TXT DKIM record under a selector shown in the domain's DNS records panel. The selector differs between older and newer accounts, so read it off the panel rather than guessing, and note that the record belongs under the sending subdomain rather than the root.

Return path and SPF alignment

The subdomain setup also asks for MX records so Mailgun can process bounces:

Because the envelope sender is then on mg.example.com, SPF aligns with a From address at example.com under relaxed matching.

DMARC alignment with Mailgun

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the Mailgun specifics:

• Tracking links use a CNAME on the sending subdomain. Skipping it leaves click tracking pointing at Mailgun's domain, which does not affect DMARC and does affect how the mail looks.
• Mailgun's EU and US regions are separate. A domain added in one is not visible in the other, and the DNS records differ.
• Sending from the root domain works and costs you the ability to keep the two reputations apart. Use the subdomain.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Mailgun to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

Our SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against Mailgun's own documentation, at Mailgun documentation. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.

A record can read correctly and still fail alignment once real mail moves through it. Receivers write that verdict into the reports they send. We read them for you, and paid plans email you the same day one names a new sender that failed, instead of holding it for Monday. See whether this sender passes. Your first domain is free.