MailgunSPF, DKIM & DMARC Setup
Mailgun recommends sending from a dedicated subdomain (e.g. mg.yourdomain.com), which keeps its SPF/DKIM records separate from your mailbox provider's and protects your root-domain reputation.
Already set up? Check what your domain publishes right now — SPF, DKIM (shown in the Mailgun dashboard (e.g. smtp or k1)), DMARC, MX, BIMI, and MTA-STS in one scan.
Run a free domain check →1. SPF record
Publish as a TXT record on the sending domain you registered in Mailgun (typically the mg. subdomain, not the root). The subdomain has its own SPF record — this doesn't conflict with your root domain's record.
TXT record
v=spf1 include:mailgun.org ~all2. DKIM (selector: shown in the Mailgun dashboard (e.g. smtp or k1))
Mailgun dashboard → Sending → Domain settings → DNS records: Mailgun shows the exact DKIM TXT record (host like <selector>._domainkey.mg.yourdomain.com) with the public key value. Copy it verbatim — the selector varies by account/domain.
3. MX records
Only add Mailgun's MX records (mxa.mailgun.org / mxb.mailgun.org, priority 10) on the sending subdomain if you use Mailgun inbound routing. Never replace your root domain's MX.
4. DMARC record
DMARC on the organizational domain covers the mg. subdomain via relaxed alignment (the default). Start at p=none; DKIM signed with mg.yourdomain.com aligns because it shares the organizational domain.
TXT record at _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comMailgun authentication FAQ
Why does Mailgun recommend a subdomain instead of my root domain?
Isolation. A subdomain keeps Mailgun's SPF/DKIM separate from your mailbox provider's records (no SPF merging), and transactional/bulk reputation issues stay off the root domain your regular mail depends on.
Does subdomain DKIM still pass my root domain's DMARC?
Yes, with default relaxed alignment: a DKIM signature from mg.yourdomain.com aligns with a DMARC policy on yourdomain.com because they share the organizational domain. Strict alignment (adkim=s) would break this — don't set it unless you know you need it.
Official documentation: Mailgun email authentication docs ↗
Verify your setup
DNS Email Diagnostics
SPF, DKIM, DMARC, MX, BIMI & MTA-STS in one check
MX Record Lookup
See exactly which mail servers your domain publishes
BIMI Validator
Show your logo in Gmail & Yahoo once DMARC is enforced
Deliverability Monitoring
Daily checks + email alerts when a record changes or breaks