SPF, DKIM and DMARC · Checked 8 November 2026

Mailgun SPF, DKIM and DMARC records

The records that let mail sent through Mailgun pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

example.com.  IN  TXT  "v=spf1 include:mailgun.org ~all"
  • Publish it as a TXT record on the domain or subdomain you send from. If it already has an SPF record, add include:mailgun.org to that record instead of creating a second one.
  • Most people send from a subdomain such as mg.example.com, so it does not interfere with the main domain's mail.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • DKIM is a TXT record whose name and value are specific to your domain. Mailgun shows them under Domain Verification & DNS in the domain's settings, so copy them from there.
  • Mailgun also lists two MX records, mxa.mailgun.org and mxb.mailgun.org, both with priority 10. They are for receiving mail through Mailgun. Publish them only on a domain or subdomain where you want Mailgun to receive mail, never on one whose mail is handled elsewhere.
  • For click and open tracking, Mailgun gives a CNAME pointing to mailgun.org.
  • Some DKIM keys can show as Unverified in the panel. Mailgun says this is acceptable as long as the key your domain requires is correctly in DNS.
  • Changes can take 24 to 48 hours.

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • MX records for Mailgun added to a domain that already receives mail elsewhere, diverting it.
  • Sending from the main domain with a second SPF record published next to the first.
  • The DKIM TXT value cut off or altered when pasted. Check it with the DKIM checker.
  • Forgetting the tracking CNAME, so links are not branded and tracking is unavailable.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What is the SPF record for Mailgun?

v=spf1 include:mailgun.org ~all as a TXT record on the sending domain, merged into any existing SPF record.

Where do I find my Mailgun DKIM record?

In the Mailgun control panel, under Domain Verification & DNS for your domain. The name and value are specific to your account.

Do I need Mailgun's MX records?

Only if you want Mailgun to receive mail for that domain. For sending only, you do not need them, and you should not add them to a domain whose mail is handled elsewhere.

Why is a Mailgun DKIM key shown as unverified?

Mailgun says some keys can show as Unverified and that this is fine as long as the key your domain requires is correctly published.