Mailgun email authentication: SPF, DKIM and DMARC
Mailgun asks for four kinds of DNS record: SPF, DKIM, a tracking CNAME and receiving MX. Only the first two matter for authentication, and the MX records can break your mailboxes if you add them to a domain that also receives mail. This guide separates what is needed from what is optional.
Record values checked against Mailgun’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Mailgun
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
SPF for Mailgun
The mechanism to add is include:mailgun.org. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.
Mailgun is your only sender
v=spf1 include:mailgun.org ~allMerging into an existing record
Before
v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~allAfter
v=spf1 ip4:203.0.113.25 include:mailgun.org include:_spf.crm.example ~allLookup budget
SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 5 DNS lookups (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 5 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.
- Mailgun’s record is v=spf1 include:mailgun.org ~all. It is the expensive kind: measured on the verification date, include:mailgun.org costs 5 DNS lookups in total because it chains to several sub-records, covering both the US and EU ranges.
- With a 10-lookup limit, Mailgun alone uses half of it. Keep Mailgun on its own sending subdomain with its own SPF record so it never competes with your mailbox provider for lookups.
- Only one SPF record per domain. If the domain already has one, add include:mailgun.org to it.
DKIM for Mailgun
Where: Mailgun control panel: Domain Verification & DNS section for your sending domain
- Open the Domain Verification & DNS section for the domain in the Mailgun control panel.
- Copy the DKIM TXT record exactly as shown (host and value). Mailgun does not publish a fixed selector in its documentation.
- Publish it at your DNS host, then use the verify button in Mailgun.
- Mailgun notes that not every DKIM key shown must verify; the key your domain’s configuration uses must be correctly set in DNS.
| Type | Name | Value |
|---|---|---|
| TXT | <selector from the control panel>._domainkey | <public key from the control panel>Host and value are per domain. Copy both from the control panel. |
Selector. The selector is shown in your Mailgun control panel, not in the documentation, so there is no fixed name to look up. Enter the one from the control panel in the DKIM checker.
- A DKIM record signed under your own domain is what lets DKIM align with your From domain.
DMARC with Mailgun
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- The DKIM key is published on your own sending domain. When the From address uses that domain, DKIM can align and DMARC passes even if SPF does not align.
- Check a real message before you enforce: the Authentication-Results header should show dkim=pass with your domain in header.d.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Tracking and receiving records
These are not authentication records. The tracking CNAME supports click, open and unsubscribe tracking. The MX records exist so Mailgun can receive mail addressed to the domain. Do not add them to a domain whose mail is delivered elsewhere.
| Type | Name | Value |
|---|---|---|
| CNAME | <tracking host from the control panel> | mailgun.orgOptional. The doc does not fix the host label; copy it from the control panel. |
| MX | <sending-domain> | 10 mxa.mailgun.orgOnly if Mailgun should receive mail for this domain. If your account is in the EU region, copy the values from the control panel instead. |
| MX | <sending-domain> | 10 mxb.mailgun.orgSecond receiving host, same condition. |
Common Mailgun mistakes
- Adding the Mailgun MX records to a domain whose mailboxes are at Google, Microsoft or another host. Inbound mail then goes to Mailgun. Use a dedicated subdomain for Mailgun.
- Putting include:mailgun.org on a root domain that already carries a mailbox provider and a few tools. At 5 lookups it quickly pushes the total past 10.
- Copying DKIM from a tutorial instead of from the control panel. Host and key are per domain.
- Copying receiving or tracking values from a guide when your account is in the EU region. Copy them from the control panel for your region.
- Two SPF records after adding Mailgun. Merge into one.
Mailgun email authentication FAQ
What SPF record does Mailgun need?
v=spf1 include:mailgun.org ~all. If the domain already has an SPF record, add include:mailgun.org to it instead of publishing a second record.
How many DNS lookups does include:mailgun.org cost?
Five in total on the verification date (the include itself plus four nested ones). Re-check with the SPF checker, because providers change their records.
Do I need the Mailgun MX records?
Only if you want Mailgun to receive mail for the domain. They are not needed to send or to authenticate, and adding them to a domain with mailboxes elsewhere would send inbound mail to Mailgun.
Where do I find the Mailgun DKIM record?
In the Domain Verification & DNS section of the Mailgun control panel for your domain. The documentation does not fix a selector name.
Can I have SPF records for both Mailgun and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Mailgun authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.