How to set up SPF, DKIM & DMARC for Mailgun

Mailgun recommends sending from a subdomain (e.g. mg.yourdomain.com), which keeps its records — and its reputation — separate from your root domain. Both records below go on that sending subdomain.

SPF

Published on the sending subdomain you registered with Mailgun, not the root domain.

Type	`TXT`
Host / Name	`mg` Your Mailgun sending subdomain (shown here as mg.yourdomain.com).
Value / Content	`v=spf1 include:mailgun.org ~all`

DKIM

Mailgun generates the key when you add the domain; the selector varies (commonly smtp or k1).

Type	`TXT`
Host / Name	`smtp._domainkey.mg` Exact host shown in the Mailgun dashboard for your sending domain.
Value / Content	`k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB…` Example only — copy it from Mailgun → Sending → Domains → your domain → DNS records.

Mailgun → Sending → Domains → Add new domain (use a subdomain like mg.yourdomain.com).
Publish the records on its DNS records page — SPF, DKIM, and the two receiving MX records if you'll receive replies there.
Click Verify DNS settings.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers Mailgun and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: With records on mg.yourdomain.com, authentication aligns with your root domain under DMARC's default relaxed mode — subdomain matches count.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from Mailgun to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is Mailgun's official docs.