How to authenticate email with Mailgun

Authenticating a domain in Mailgun means publishing the DNS records that let Mailgun sign and send mail as your domain — a DKIM TXT record, an SPF record, and a tracking CNAME. Do it and your transactional and bulk mail is signed as you, SPF aligns to your sending subdomain, DMARC passes, and click/open tracking uses your own branded links instead of Mailgun's. It's four DNS records and a verify click.

Written & reviewed by the VerifyAnyEmail team · Last reviewed July 2026

The short version: Mailgun gives you two “required” records for authentication (a DKIM TXT and an SPF TXT) and two recommended records (a tracking CNAME and an MX pair for inbound), and until they resolve your domain stays unverified and can only send from Mailgun’s sandbox. Most people add Mailgun on a dedicated sending subdomain like mg.example.com, which keeps its reputation and SPF separate from your main domain. This guide walks the records, where to verify them in Mailgun, and how to confirm DMARC aligns.

The records Mailgun needs

Mailgun generates the exact hostnames and values per domain in its control panel — always copy those, not the placeholders here. For a subdomain setup (mg.example.com) the set looks like this:

DKIM (TXT). Mailgun signs with a selector such as smtp or a Mailgun-specific selector. The record is a long public key published under _domainkey:

Type: TXT Host: smtp._domainkey.mg.example.com Value: "k=rsa; p=MIGfMA0GCSq..."   (full public key from your Mailgun dashboard)

SPF (TXT). Authorise Mailgun’s sending IPs on your sending domain. On a dedicated subdomain this is usually a clean, standalone record:

Type: TXT Host: mg.example.com Value: "v=spf1 include:mailgun.org ~all"

Tracking (CNAME). Branded open/click tracking so links point at your subdomain instead of Mailgun’s shared domain:

Type: CNAME Host: email.mg.example.com Value: mailgun.org        (use the exact target Mailgun shows)

Mailgun also lists two MX records — those are only needed if you want Mailgun to receive inbound mail or process bounces on the subdomain; for outbound-only sending you can skip them, though adding them helps bounce handling. Follow Mailgun’s current screens: Verify your domain (Mailgun docs).

Where to start in Mailgun

In the Mailgun dashboard open Sending → Domains, click Add New Domain, and enter your sending subdomain (e.g. mg.example.com). Mailgun then shows the DNS records above with copy buttons. Paste each into your DNS host — if that’s Cloudflare, GoDaddy, Namecheap or Route 53, see the linked registrar guides below — then click Verify DNS Settings in Mailgun. Records usually propagate within minutes but can take up to 24–48 hours; Mailgun re-checks automatically.

Why DMARC alignment matters here

DMARC passes only when SPF or DKIM aligns with the visible From: domain, not merely when it passes. Because Mailgun’s DKIM signs as your subdomain and the SPF include:mailgun.org is published on your subdomain, both can align to you@mg.example.com — or to example.com under relaxed alignment, which is the default. If you send with a From: on your root domain but authenticate only the subdomain, make sure your DMARC uses relaxed alignment (adkim=r, aspf=r) so the subdomain counts. Aligned DKIM is the more robust target because it survives forwarding; SPF breaks when mail is relayed. For the underlying mechanics see the complete SPF/DKIM/DMARC guide and why DKIM passes but DMARC fails. No DMARC record yet? Generate one with the DMARC Generator.

Verify it worked

  • Confirm the DKIM key resolves and matches what Mailgun signs with using the DKIM Checker (query the smtp._domainkey.mg selector).
  • Check the SPF record is valid and under ten lookups with the SPF Checker.
  • Validate your policy with the DMARC Checker, then send a live test and confirm the header shows dkim=pass and dmarc=pass aligned to your domain.

Keep DMARC monitoring on so any misconfigured source shows up in a report instead of a bounce spike.

Common mistakes

  • Adding include:mailgun.org to the wrong record. On a subdomain setup the SPF belongs on mg.example.com, not your root. Stacking it onto an existing root SPF that’s already near the ten-lookup limit can cause a permerror — see too many DNS lookups.
  • Two SPF records on one host. Only one v=spf1 record per name is allowed; a second voids SPF entirely.
  • Proxying the tracking CNAME. On Cloudflare keep it DNS-only (grey cloud), or open/click tracking and verification break — see Cloudflare records.
  • Truncating the DKIM TXT. Long keys are sometimes split into multiple quoted strings; paste the whole value or the signature fails.
  • Forgetting relaxed alignment. If your visible From is the root domain but you authenticate a subdomain, strict alignment (s) will fail DMARC. Use relaxed.
  • Expecting inbox placement from auth alone. Authentication is necessary, not sufficient — verify your list with the Email Verifier and watch reputation.

Related setup guides: Mailchimp, Postmark, Brevo, Klaviyo and Zoho Mail.

Check your domain in seconds

Run the free diagnostics referenced in this guide — no sign-up needed.

Email Health CheckAll tools

More guides

🧹 How to Clean an Email List Before a Campaign (2026 guide)
A step-by-step workflow to dedupe, validate and verify a list before you hit send — and keep bounces low.
🔬 How Email Verification Works (Without Sending an Email)
Syntax → MX → live SMTP probe → catch-all/role/disposable checks: the real pipeline, explained.
🚦 Deliverable, Risky, Catch-All & Unknown: How to Handle Every Verification Result
What each verification status means and the safe action to take — from sign-up forms to bulk sends.
🎯 Should You Send to Catch-All Emails? (2026)
Catch-all domains accept everything, so SMTP can’t confirm the mailbox. A practical decision framework.