emailsecops
Menu
Guides

Mailgun SPF, DKIM and DMARC setup

Publish v=spf1 include:mailgun.org ~all and the DKIM key Mailgun assigns on your sending domain, ideally a subdomain such as mg.example.com. SPF and DKIM both align with a From address on that domain, or on its parent under relaxed alignment.

Transactional email API · reviewed October 13, 2026 against Mailgun's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Mailgun account: copy it from Mailgun's setup screen, which shows the exact record.

ForTypeHostValue
SPF TXT {domain} v=spf1 include:mailgun.org ~all{domain} is the sending domain you add to Mailgun; merge the include into any SPF record already there.
DKIMTXT key TXT {selector}._domainkey.{domain} k=rsa; p={public-key}Use the selector and value Mailgun assigns, such as pic, krs or smtp; Mailgun's values have no v=DKIM1.
DKIMAutomatic Sender Security CNAME pdk1._domainkey.{domain} pdk1._domainkey.{id}.dkim1.mailgun.comReplaces the TXT key with 2048-bit keys Mailgun rotates, every 120 days by default; copy the target from Mailgun.
DKIMAutomatic Sender Security CNAME pdk2._domainkey.{domain} pdk2._domainkey.{id}.dkim1.mailgun.com
Receiving mailUS region optional MX {domain} priority 10 · mxa.mailgun.orgOptional for sending, but Mailgun calls MX virtually required to avoid Sender Address Verification bounces.
Receiving mailUS region optional MX {domain} priority 10 · mxb.mailgun.orgEU region domains use mxa.eu.mailgun.org and mxb.eu.mailgun.org instead.
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Mailgun asks bulk senders to publish at least p=none.

SPF

On the sending domain you add to Mailgun: v=spf1 include:mailgun.org ~all, merged into any SPF record already there. Mailgun uses the sending domain itself as the MAIL FROM host, so SPF aligns with a From address on that domain, or on its parent under relaxed alignment (aspf=r).

DKIM

Without Automatic Sender Security, you publish a 1024- or 2048-bit TXT key under the selector Mailgun assigns per domain (examples: pic, krs, smtp) and rotate it yourself, with up to 3 keys per domain. With Automatic Sender Security, two CNAMEs at pdk1._domainkey and pdk2._domainkey point to 2048-bit keys Mailgun rotates every 120 days by default.

DMARC alignment

Both align when the From domain is the Mailgun sending domain, or its parent under relaxed alignment: SPF because the MAIL FROM host is the sending domain, DKIM because the key is published under it (or under the root domain when that is the DKIM authority).

Common mistakes

  • Only one SPF record per hostname: merge include:mailgun.org into an existing record and stay within the 10-lookup limit.
  • A CNAME hides every other record on the same name, and some DNS hosts auto-create an email CNAME, so change Mailgun's tracking hostname if it clashes.
  • Only Mailgun's MX records may be on the sending domain, so use a subdomain if the domain already receives mail elsewhere.
  • A DMARC record with aspf=s fails when the MAIL FROM is mg.example.com and the From is example.com; use relaxed alignment or a From address on the sending subdomain.
  • EU domains use mxa.eu.mailgun.org, mxb.eu.mailgun.org and eu.mailgun.org for tracking, and a domain's region can't be changed after creation.
  • Extra DKIM keys may show as Unverified after rotation or after enabling Automatic Sender Security; only the key the domain uses must verify.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Mailgun

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • Default DKIM selectors: pdk1, pdk2
  • DKIM keys delegated (CNAME) to *.mailgun.com

Questions

What SPF record does Mailgun need?+
On the sending domain you add to Mailgun: v=spf1 include:mailgun.org ~all, merged into any SPF record already there. Mailgun uses the sending domain itself as the MAIL FROM host, so SPF aligns with a From address on that domain, or on its parent under relaxed alignment (aspf=r).
What are the DKIM records for Mailgun?+
Without Automatic Sender Security, you publish a 1024- or 2048-bit TXT key under the selector Mailgun assigns per domain (examples: pic, krs, smtp) and rotate it yourself, with up to 3 keys per domain. With Automatic Sender Security, two CNAMEs at pdk1._domainkey and pdk2._domainkey point to 2048-bit keys Mailgun rotates every 120 days by default.
Does Mailgun mail pass DMARC?+
Both align when the From domain is the Mailgun sending domain, or its parent under relaxed alignment: SPF because the MAIL FROM host is the sending domain, DKIM because the key is published under it (or under the root domain when that is the DKIM authority).
Do I need a separate DMARC record for Mailgun?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources