Mailgun authenticates the domain you add to it, which is usually a subdomain such as mg.example.com. On that domain you publish v=spf1 include:mailgun.org ~all and a DKIM key, either two pdk1/pdk2 CNAMEs with Automatic Sender Security or a TXT key. Add a _dmarc record on your root domain, and DMARC passes on both SPF and DKIM.
The records at a glance
For a sending domain of mg.example.com with Automatic Sender Security on:
| Type | Host | Value |
|---|---|---|
| TXT | mg |
v=spf1 include:mailgun.org ~all |
| CNAME | pdk1._domainkey.mg |
pdk1._domainkey.<id>.dkim1.mailgun.com |
| CNAME | pdk2._domainkey.mg |
pdk2._domainkey.<id>.dkim1.mailgun.com |
| TXT | _dmarc (root) |
v=DMARC1; p=none; rua=mailto:dmarc@example.com |
Mailgun's verification page also lists a tracking CNAME (pointing to mailgun.org) for clicks, opens and unsubscribes, and MX records mxa.mailgun.org and mxb.mailgun.org at priority 10 for receiving. Neither affects SPF, DKIM or DMARC. Add the MX records only to a subdomain whose mail Mailgun should receive. Never put them on a root domain that already receives mail in Google Workspace or Microsoft 365.
Add the domain in Mailgun
From Mailgun's custom domains guide:
- Open the Mailgun Control Panel.
- Click Send, then Sending, then Domains.
- Click Add new domain and type the domain, for example
mg.example.com. - Pick the Domain region (US or EU) and the IP assignment option.
- Turn on Automatic Sender Security if offered, then click Add Domain.
- Copy the records from the domain's DNS records page into your DNS host.
Mailgun's domain best practices suggest keeping the top-level domain for corporate mail and separate subdomains for transactional and marketing mail. Each Mailgun domain gets its own queue as well as its own reputation.
SPF: on the sending domain, not the root
The SPF record goes on the domain you added. If you added mg.example.com, publish it there:
mg.example.com TXT "v=spf1 include:mailgun.org ~all"
include:mailgun.org is heavier than it looks. When we resolved it on 19 October 2026, it chained through _spf.mailgun.org, _spf1.mailgun.org, _spf2.mailgun.org and _spf.eu.mailgun.org. That is five DNS lookups of the 10 that RFC 7208 allows. On a dedicated mg subdomain that is no problem, because nothing else shares the record.
On a root domain it is a different story. In our scan of the Tranco top 1,000 domains on 19 October 2026, 33 root SPF records included mailgun.org. Of those, 22 also included Google Workspace and 15 included Zendesk. Stack those and you pass 10 quickly, and every message then fails SPF with a permerror. Paste your domain into the SPF checker to see the total. If Mailgun sends only from mg.example.com, the root does not need the include at all.
To confirm which domain SPF is checked against, send a test and read the Return-Path header. It should show an address at your Mailgun sending domain.
DKIM: Automatic Sender Security or a manual key
Automatic Sender Security (CNAME)
Mailgun's DKIM Security page describes two CNAMEs:
pdk1._domainkey.mg.example.com CNAME pdk1._domainkey.9d876.dkim1.mailgun.com
pdk2._domainkey.mg.example.com CNAME pdk2._domainkey.9d876.dkim1.mailgun.com
9d876 stands in for an ID unique to your domain. The keys are 2048-bit, live on Mailgun's side, and rotate every 120 days by default. You can change the rotation period, down to a minimum of 5 days. Two selectors let Mailgun bring in a new key while the old one still verifies cached lookups.
An existing domain that uses a TXT key can switch to Automatic Sender Security from its DNS records page.
Manual key (TXT)
Without Automatic Sender Security, you pick a selector that is unique to the sending domain and let Mailgun generate a 1024-bit or 2048-bit key, or import your own as a PEM file. You then publish a TXT record at <selector>._domainkey.mg.example.com. Mailgun warns that some DNS hosts make you split a 2048-bit key into two parts, the 255-character string limit again. Mailgun can sign with up to three keys at once and rotates through them in turn.
Mailgun's note on the DNS records page: some DKIM keys may show Unverified, for example after a rotation. That is fine as long as the key the domain actually uses is published correctly.
How Mailgun aligns for DMARC
DMARC on the root domain example.com covers mail from mg.example.com too, since a subdomain without its own record inherits the parent's policy.
- DKIM alignment. Mailgun signs with the sending domain,
d=mg.example.com. Under relaxed DKIM alignment, the default, that aligns with a From address atmg.example.comand also with one atexample.com. - SPF alignment. The envelope sender is at the sending domain, so SPF is checked on
mg.example.comand aligns under relaxed SPF alignment.
Strict alignment (adkim=s or aspf=s) only works if your From address uses exactly the Mailgun domain. Send from orders@example.com through mg.example.com with strict alignment, and both checks fail.
DMARC record
Publish one TXT record on the root:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Leave adkim and aspf out to keep relaxed alignment. The DMARC generator builds the record, and the DMARC analyzer shows Mailgun's IPs next to your other senders once reports arrive.
Verify and check
Mailgun says DNS can take 24 to 48 hours to fully propagate. It checks the domain on its own, or you can click Verify DNS settings in the domain settings. A verified domain gets a green Verified badge, loses the "sent via Mailgun.org" note, and is no longer capped at 300 messages a day.
Then check from outside: the DKIM checker with your own sending domain, the SPF checker on both the sending domain and the root, and the DMARC checker on the root.