Mailgun Email Authentication: SPF, DKIM & DMARC

Mailgun's onboarding does much of the work: add a sending domain and it generates the full DNS record set. The records only help if you publish all of them — including the MX pair for bounces — publish them once (a duplicate SPF breaks the domain), and add the DMARC record Mailgun does not create for you.

This guide walks the record set, why each record exists, verification and the traps. Protocol basics are in the email authentication overview; if you are choosing an ESP, compare with the SendGrid setup.

What you need

• A Mailgun account with access to Sending > Domains.
• DNS write access. Cloudflare pitfalls are in the Cloudflare DNS guide.
• A region decision — US or EU — made when adding the domain: the records differ, and the region must match your application's configuration.

Step 1: Add a sending domain

Go to Sending > Domains > Add New Domain. Mailgun recommends a dedicated subdomain such as mail.yourdomain.com rather than the root: it generates its own SPF and DKIM records for whatever name you give it, and publishing them at the root would collide with your corporate mail records. Pick the region matching your plan and add the domain.

Step 2: Publish the record set

Open the domain and review the DNS records Mailgun provides. For mail.yourdomain.com they look like this:

Type   Host                      Value
TXT   mail.yourdomain.com        v=spf1 include:mailgun.org ~all
CNAME  smtp._domainkey.mail      dl._domainkey.mail.yourdomain.com.wl123.mailgun.org
TXT    krs._domainkey.mail       (additional DKIM public key)
MX     mail.yourdomain.com (10)  mxa.mailgun.org
MX     mail.yourdomain.com (10)  mxb.mailgun.org
CNAME  email.mail                (link/open tracking)

• SPF TXT authorizes Mailgun's IPs for the envelope domain. Because mail is enveloped from mail.yourdomain.com, a subdomain of your From domain, SPF can align under relaxed DMARC — the same pattern as the SendGrid guide.
• The smtp._domainkey CNAME is the DKIM key for the selector Mailgun signs with (d= your domain, so DKIM aligns). As a CNAME it lets Mailgun rotate keys on their side. Keys are 2048-bit — do not downgrade.
• krs._domainkey TXT is an additional DKIM key under its own selector, included in newer record sets. Publish it as given.
• The MX pair collects bounces at mail.yourdomain.com for suppression lists and analytics. Add them even if you only send: without a bounce route, invalid addresses accumulate and you keep paying to send to them.
• The tracking CNAME rewrites links to your subdomain. It is HTTP, so it is the one mail record that may be proxied on Cloudflare.

Do not merge the SPF TXT into your root record and leave the subdomain empty — the envelope sender uses the subdomain, so its SPF must exist there.

Step 3: Verify and activate

Click Verify DNS Settings. Mailgun re-checks each record and marks them green; propagation is usually minutes but can take up to 24–48 hours. To confirm independently:

dig TXT mail.yourdomain.com +short
dig CNAME smtp._domainkey.mail.yourdomain.com +short

Or skip the terminal: TXT lookup and the DKIM Checker (selector smtp). The domain becomes Active — able to send — once SPF, DKIM and tracking verify. Mailgun also emits a "DNS records verified" webhook event you can use to automate activation.

Step 4: DMARC is on you

Mailgun does not publish DMARC. Create the TXT record yourself at _dmarc.yourdomain.com (a separate policy at _dmarc.mail.yourdomain.com is optional):

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1

Start at p=none, confirm every Mailgun stream aligns in the DMARC Report Analyzer, then tighten gradually — generate the record with the DMARC Generator. Never jump to p=reject without a monitoring period.

End-to-end verification

Send a test through Mailgun to an external inbox and inspect the headers — Show original in Gmail or the header analyzer:

spf=pass smtp.mailfrom=mail.yourdomain.com
dkim=pass (2048-bit key) header.d=mail.yourdomain.com
dmarc=pass header.from=yourdomain.com

Then run the Email Health Check or the Email Deliverability Test for the domain, and check sending reputation with the Blacklist Checker before scaling volume.

Common mistakes

• Publishing Mailgun's SPF at the root. The record set is generated for the subdomain you added. Copying the include into the root without the subdomain setup breaks alignment.
• Skipping the MX records. Bounces vanish, so Mailgun cannot suppress invalid addresses.
• Duplicating SPF. If the subdomain already had a v=spf1 TXT from a previous provider, replace it — two records fail permanently.
• Proxied CNAMEs on Cloudflare. DKIM and Return-Path records must be DNS only; only link tracking may be proxied.
• Ignoring the region choice. US and EU accounts use different hosts; sending through the wrong one fails authentication.

Frequently asked questions

Why both a CNAME and TXT records for DKIM?

The smtp._domainkey CNAME points at a Mailgun-managed key so rotation needs no DNS change; the additional TXT (such as krs._domainkey) publishes further keys under separate selectors. Publish exactly what your record set shows — sets vary by account age and region.

Do I need include:mailgun.org in the root SPF too?

Only if you send From addresses at the root domain through Mailgun. With the recommended subdomain setup, the subdomain's SPF is what matters.

Should extra DKIM keys be 2048-bit?

Yes. Mailgun offers 1024 or 2048 bits when you create a key; 1024 is considered weak and some receivers reject it. 2048-bit values are longer and may need splitting into multiple TXT strings — publish the value exactly as provided.