Setup guide

Mailgun: SPF, DKIM and DMARC

Mailgun usually runs on a subdomain such as mg.yourdomain.com with its own SPF include. DKIM uses either two CNAME records delegated to Mailgun (Automatic Sender Security) or a TXT key you manage yourself.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Mailgun documentation on October 13, 2026

DNS records to add

TXTHost<mg>

v=spf1 include:mailgun.org ~all

SPF for the sending subdomain (use eu.mailgun.org for the EU region)

CNAMEHostpdk1._domainkey.<mg>

<pdk1 target from Mailgun, like pdk1._domainkey.<id>.dkim1.mailgun.com>

Replace the part in angle brackets with your own value before publishing.

DKIM key 1 with Automatic Sender Security (Mailgun rotates it)

CNAMEHostpdk2._domainkey.<mg>

<pdk2 target from Mailgun, like pdk2._domainkey.<id>.dkim1.mailgun.com>

Replace the part in angle brackets with your own value before publishing.

DKIM key 2 with Automatic Sender Security

TXTHost<selector>._domainkey.<mg>

<DKIM value from Mailgun → Sending → Domains → DNS records>

DKIM signing key if you manage keys manually instead

MXHost<mg>

10 mxa.mailgun.org

Receiving and bounce handling (optional)

Steps

In Mailgun open Sending → Domains → your domain → DNS records. To use Automatic Sender Security, turn it on under Advanced settings when you add a new domain, or for an existing domain choose Turn on automatic sender security from the Actions menu in the Sending records section.
Publish the SPF TXT record and either the two pdk CNAME records (Automatic Sender Security) or the DKIM TXT record (manual keys), plus the MX records if you want Mailgun to receive mail.
Click Verify DNS settings so Mailgun checks the records, or wait for its automatic verification.

Common mistakes

Pointing your root domain's MX records to Mailgun while your mailboxes live elsewhere breaks receiving, because only one server can receive mail for a domain. Use a subdomain for Mailgun instead.
Leaving the sending subdomain without MX records can increase "Sender Domain Verification" errors from recipient servers. Point its MX to Mailgun or another incoming server.
Until the domain is verified, Mailgun caps sending at 300 emails per day and messages carry a "sent via Mailgun.org" notice.

Good to know

Match the region: EU accounts use eu.mailgun.org in SPF and mxa.eu.mailgun.org for MX.
When you switch an existing domain to Automatic Sender Security, Mailgun keeps signing with the existing DKIM TXT key until the pdk CNAME records are verified.

Frequently asked questions

Can I use the same domain for Mailgun and Google Workspace?

For sending, yes: several services can send for one domain. For receiving, no; don't point the MX records to Mailgun if another server receives your mail.

How does Mailgun rotate DKIM keys?

With Automatic Sender Security you delegate pdk1._domainkey and pdk2._domainkey to Mailgun via CNAMEs, and Mailgun rotates the 2048-bit keys every 120 days by default (minimum 5 days).

Why is a 2048-bit Mailgun DKIM key harder to publish?

The longer record is harder to set up, and some DNS providers require splitting it into two parts. Manual keys can be 1024 or 2048 bits, and 2048-bit is more secure.

Why do some of my Mailgun DKIM keys show as unverified?

Extra keys can appear because of rotation. Only the key set in your domain's configuration has to be published in DNS.

How soon can Mailgun verify the domain after I publish the records?

Mailgun says DNS propagation typically takes 24–48 hours. After that the domain verifies automatically, or you can trigger verification in the Control Panel or with the Verify API.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Mailgun documentation.

Check your Mailgun setup

Or open the SPF checker, DKIM checker or DMARC checker directly.