Mailgun: DKIM and SPF setup
Before you start
Mailgun sends from a sending domain that you add and verify. Mailgun recommends a subdomain of example.com, such as mail.example.com. The examples below use that name. You need access to the DNS settings of example.com. Mailgun's pages do not name a Mailgun role or plan for the setup.
Mailgun says an unverified domain is limited to 300 emails a day and shows "sent via Mailgun.org" in your messages.
Turn on DKIM
Verifying the sending domain sets up DKIM and SPF together.
- Log in to the Mailgun Control Panel. In the left navigation, click Sending, then Domains.
- Click Add New Domain, fill in the sending domain, such as
mail.example.com, and click Add Domain. - Mailgun shows the DNS records to add. Add them at your DNS host.
The records Mailgun asks for:
| Type | Host | Value | Purpose |
|---|---|---|---|
| TXT | mail.example.com |
v=spf1 include:mailgun.org ~all |
SPF |
| TXT or CNAME | shown in Mailgun | shown in Mailgun | DKIM |
| MX | mail.example.com |
10 mxa.mailgun.org and 10 mxb.mailgun.org |
receiving |
| CNAME | email.mail.example.com |
mailgun.org |
open and click tracking |
For DKIM, Mailgun offers two forms. Mailgun's setup guide shows a TXT record at mx._domainkey.mail.example.com. With Automatic Sender Security, Mailgun uses two CNAME records instead, such as pdk1._domainkey.mail.example.com and pdk2._domainkey.mail.example.com, pointing to Mailgun's DKIM hosts. Mailgun then rotates the key every 120 days by default without DNS changes. Copy the exact names and values from the Domain Verification & DNS section in Mailgun.
Mailgun says the TXT records for SPF and DKIM are the ones required to send. The MX records are needed only if Mailgun should receive mail for the sending domain. Do not add them to a domain whose mail goes elsewhere, or that mail stops arriving. Mailgun says the tracking CNAME is needed only for its tracking of clicks, opens and unsubscribes.
Sign with your own domain
Mailgun's DMARC article gives the conditions for aligned mail. The DKIM record of your Mailgun sending domain is in DNS and verified by Mailgun. The From address uses that sending domain or its root. For a sending domain mail.example.com, a From address at mail.example.com or at example.com works.
If reports show Mailgun mail signed by a domain other than example.com, check which sending domain the mail went out through, and verify it as in Turn on DKIM.
Use your own bounce domain
Mailgun puts the SPF record on the sending domain itself, such as mail.example.com, and asks for no separate bounce record. The Mailgun pages this guide is written from describe no other return path setting. Verify the sending domain as in Turn on DKIM.
SPF aligns only with relaxed alignment when the sending domain is a subdomain and the From address uses example.com. Mailgun says not to use aspf=s in your DMARC record in that case.
SPF
Mailgun's SPF record goes on the sending domain. If the sending domain is example.com itself and it already has an SPF record, add include:mailgun.org to that record instead of creating a second one. Put it after v=spf1 and before ~all, for example v=spf1 include:_spf.google.com include:mailgun.org ~all. Keep the record within 10 DNS lookups.
Mailgun also says a CNAME on the sending domain takes precedence over its TXT record. Remove the CNAME, or use another subdomain such as mg.example.com.
Check the DKIM key
Mailgun may show several DKIM keys for a domain, some of them Unverified. Mailgun says this is expected after key rotation, after you add keys, or when manual keys remain after you turn on Automatic Sender Security. Only the key the domain is configured to use needs to be in DNS.
If the DKIM record is verified but SPF is not, check that the sending domain has only one SPF record and no CNAME.
Check it worked
- Mailgun checks the records itself and emails you when the domain is verified. To check at once, go to Sending, Domain settings, open the DNS records tab, choose the domain in the Domain list and click Check status. Verified domains show a green Verified badge.
- Mailgun says DNS changes can take 24 to 48 hours.
- Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM and SPF align for Mailgun. The DKIM table on Mailmoni's DNS tab lists Mailgun's selectors, such as
pdk1, once a report includes them.
Mailgun's pages: Domain Verification Setup Guide, Domain Verification, DKIM Security, DNS frequently asked questions and DMARC.