Do I have to add include:mailgun.org, or is there a CNAME like SendGrid?

You add it. Mailgun is a true SPF include provider — SPF is a TXT record you publish (v=spf1 include:mailgun.org ~all), and there's no CNAME that satisfies SPF for you. Automatic Sender Security only changes DKIM to auto-rotating CNAMEs; the SPF include stays exactly the same either way.

Should I authenticate my root domain or a subdomain?

Use a subdomain like mg.yourdomain.com. It keeps Mailgun's sending reputation separate from your day-to-day mailboxes, avoids MX conflicts with Google/Microsoft, and keeps the heavy SPF include off your root domain's ten-lookup budget. Your visible From can still be an address on the subdomain, and DMARC aligns to your root either way through relaxed alignment.

Why does include:mailgun.org eat so many DNS lookups?

Because one line covers both sending regions. It expands to the US includes (_spf.mailgun.org, which further nests _spf1 and _spf2) plus the EU include (_spf.eu.mailgun.org) — five lookups total, verified against live DNS. If you only send from the EU region you can replace it with include:_spf.eu.mailgun.org, which is pure ip4 and costs a single lookup.

US or EU — which region's records do I use?

Whichever region you created the domain in. US domains are managed at app.mailgun.com and their tracking/MX records point at mailgun.org hosts; EU domains are managed at app.eu.mailgun.com and point at eu.mailgun.org hosts. The SPF line (include:mailgun.org) is identical in both regions because that one include already covers the US and EU IP ranges. Records copied from the wrong region will never verify.

Automatic Sender Security or the classic DKIM TXT — which should I choose?

Automatic Sender Security for almost everyone. It delegates DKIM to two CNAMEs that Mailgun rotates for you, so you never re-paste a key or worry about the 255-character TXT string limit. Choose the classic single DKIM TXT only if you have a policy reason to hold the key yourself — you'll then be responsible for rotating it and re-editing DNS by hand. Either way SPF and the DMARC setup are unchanged.

My SPF and DKIM pass but DMARC still fails — what's wrong?

DMARC needs alignment, not just a pass. Confirm the DKIM d= is your sending subdomain (mg.yourdomain.com) and that the Return-Path/MAIL FROM is on the same domain — both should share your organizational domain with the visible From, which relaxed alignment allows. Also make sure your _dmarc record lives on the organizational root (_dmarc.yourdomain.com), not on the mg subdomain, since the root policy already covers the subdomain.

SPF setup guide

SPF, DKIM & DMARC for Mailgun.

Mailgun (now part of Sinch) authenticates your domain from the Sending → Domains area, where you add a small set of DNS records to a dedicated sending subdomain such as mg.yourdomain.com rather than your bare root. Unlike CNAME-only providers such as SendGrid or Klaviyo, Mailgun is a true SPF include provider: you publish v=spf1 include:mailgun.org ~all yourself, alongside a DKIM record (a modern auto-rotating CNAME pair via Automatic Sender Security, or a classic static TXT) and an optional tracking CNAME. The exact hostnames and key values are per-account and shown in your dashboard. Once every record shows a green checkmark, Mailgun sends as your domain with SPF and DKIM aligned so DMARC passes.

SPF include

Your DNSAdd the CNAME / TXT records

MailgunSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Mailgun?

Authenticating your Mailgun domain is what gets your mail into the inbox rather than the spam folder or a bounce. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing similar requirements for high-volume senders to Outlook/Hotmail/Live in 2025. Until you add and verify your own domain, Mailgun only lets you send from its sandbox domain (sandboxXXXX.mailgun.org), which is capped at a handful of pre-authorized recipients and carries no reputation of your own — useless for production. Verifying your domain moves you onto real sending where SPF and DKIM both align to your organizational domain, DMARC passes, and the sending reputation you build accrues to your domain instead of shared infrastructure. Because Mailgun is API/SMTP-first and heavily used for transactional mail (password resets, receipts, alerts), a broken record here silently drops mail your users are actively waiting for.

The SPF reality for Mailgun

Mailgun is a genuine SPF include provider, so there is a real record to add: v=spf1 include:mailgun.org ~all. There is no CNAME that satisfies SPF for you the way SendGrid's em subdomain does — you publish this TXT yourself, and it applies whether you use modern Automatic Sender Security or the classic DKIM method (that toggle only changes DKIM, never SPF). The catch is that include:mailgun.org is unusually heavy. Verified against live DNS, it resolves to five nested lookups: mailgun.org publishes v=spf1 include:_spf.mailgun.org include:_spf.eu.mailgun.org -all, _spf.mailgun.org further nests include:_spf1.mailgun.org and include:_spf2.mailgun.org, so a single line covers both the US and EU sending regions. That is half of the RFC 7208 ten-lookup budget in one include. The right move — and Mailgun's own recommendation — is to put Mailgun on a dedicated sending subdomain like mg.yourdomain.com. The include then lives in that subdomain's own SPF record and costs nothing against your root domain's SPF, so it never collides with Google Workspace, Microsoft 365, or other senders already stacked on your root. If you only ever send from the EU region, you can narrow the mechanism to include:_spf.eu.mailgun.org, which is pure ip4 and costs a single lookup.

Two ways to set it up

Recommended

Automatic Sender Security — CNAME DKIM (recommended)

Two CNAMEs (labels shown in your dashboard, e.g. pdk1._domainkey and pdk2._domainkey) delegate DKIM to Mailgun's infrastructure
Mailgun generates 2048-bit keys and rotates them automatically on a schedule it manages (you can force a rotation any time)
No public key to paste and nothing to re-edit in DNS when keys roll over
Enable the toggle when you add the domain — it is off by default
SPF is still v=spf1 include:mailgun.org ~all; Automatic Sender Security only changes how DKIM is delivered

Legacy

Classic — single DKIM TXT (default / legacy)

One TXT record at the <selector>._domainkey host Mailgun shows, holding k=rsa; p=<long base64>
The key is static: you must rotate it in Mailgun and re-edit DNS by hand
2048-bit keys often exceed the single-string TXT limit and must be split into two quoted strings
This is what you get if you leave Automatic Sender Security off — functional, but no automatic rotation

Step by step

In Mailgun

1
Open Sending → Domains
Log in at app.mailgun.com (US) or app.eu.mailgun.com (EU), then go to Sending → Domains in the left menu and click Add New Domain.
2
Use a sending subdomain, not your root
Enter a subdomain such as mg.yourdomain.com (mail. or email. are also fine) rather than the bare yourdomain.com. This keeps Mailgun's sending reputation separate from your corporate mailboxes, avoids MX conflicts with Google/Microsoft, and keeps the heavy SPF include off your root domain.
3
Pick the correct region
Choose US or EU when creating the domain. The region decides whether your tracking/MX records point at mailgun.org or eu.mailgun.org hosts and which app URL manages the domain. Records from the wrong region will never verify.
4
Enable Automatic Sender Security
During setup, turn on Automatic Sender Security (it is off by default). This delivers DKIM as two auto-rotating 2048-bit CNAMEs so you never re-edit keys. Leave it off only if you specifically want a static, self-managed DKIM TXT.
5
Open the DNS records list
After the domain is created, open it and view Domain Settings → DNS records (the Domain Verification & DNS panel). Mailgun lists your SPF TXT, the DKIM record(s), the optional tracking CNAME, and optional MX — with the exact per-account values to copy.

In your DNS

6
Add the SPF TXT record
On the sending subdomain, add a TXT record: host mg (i.e. mg.yourdomain.com), value v=spf1 include:mailgun.org ~all. If that subdomain somehow already has an SPF record, merge include:mailgun.org into the existing one — never publish two SPF records on the same host.
7
Add the DKIM record(s)
With Automatic Sender Security on, add the two CNAMEs Mailgun shows (labels like pdk1._domainkey.mg and pdk2._domainkey.mg) pointing to their Mailgun-hosted dkim1.mailgun.com targets. With it off, add the single DKIM TXT at the selector shown (a <selector>._domainkey.mg host) containing k=rsa; p=…; split a 2048-bit key into two quoted strings if your DNS host requires it.
8
Add the tracking CNAME (recommended)
Add a CNAME: host email.mg → value mailgun.org (US) or eu.mailgun.org (EU). This rewrites open/click-tracking links to use your domain instead of Mailgun's. It is optional for delivery but recommended for branding and deliverability.
9
Add MX only if you receive mail
If Mailgun should receive/route inbound mail on the subdomain, add two MX records at priority 10: mxa.mailgun.org and mxb.mailgun.org (EU: mxa.eu.mailgun.org / mxb.eu.mailgun.org). Skip MX entirely for send-only, and never repoint your root MX at Mailgun if Google or Microsoft hosts your inbox.
10
Grey-cloud any Cloudflare CNAMEs
If your DNS is on Cloudflare, set the DKIM _domainkey CNAMEs and the email tracking CNAME to DNS only (grey cloud). An orange-cloud proxied CNAME won't resolve to Mailgun and verification fails. (SPF, DKIM TXT and DMARC are TXT records and aren't affected by the proxy.)

Verify

11
Click Verify DNS Settings
Back in Mailgun's Domain Settings, click Verify DNS Settings and wait for a green checkmark on every record. Propagation is usually minutes but can take up to 24–48 hours; Mailgun also re-checks automatically, so re-click if a record is still amber.
12
Send from the verified domain
In your app or SMTP settings, send from an address on the verified subdomain (e.g. no-reply@mg.yourdomain.com) — never from the sandbox domain. Send a test and confirm it authenticates (SPF, DKIM and DMARC all PASS, aligned to your domain) before pointing production traffic at it.

Records to add

Mailgun generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	mg	v=spf1 include:mailgun.org ~allSPF on the sending subdomain (mg.yourdomain.com). Merge into the existing record if one is already present — one SPF per host. EU-only senders can use include:_spf.eu.mailgun.org (a single lookup).
CNAME	pdk1._domainkey.mg	pdk1._domainkey.<hash>.dkim1.mailgun.comDKIM key 1 — Automatic Sender Security (auto-rotated). Host label and target are shown per-account in your dashboard.
CNAME	pdk2._domainkey.mg	pdk2._domainkey.<hash>.dkim1.mailgun.comDKIM key 2 — auto-rotated alongside key 1 for smooth, gapless key transitions.
TXT	<selector>._domainkey.mg	k=rsa; p=MIGfMA0GCSqGSIb3DQEB...IDAQABClassic single DKIM TXT — ONLY if Automatic Sender Security is off. Selector and key are per-account; split 2048-bit keys into two quoted strings if your host requires it.
CNAME	email.mg	mailgun.orgOpen/click tracking on your domain. EU region uses eu.mailgun.org. Optional.
MX	mg	mxa.mailgun.orgPriority 10. Only if Mailgun receives inbound mail. Also add mxb.mailgun.org (priority 10). EU: mxa/mxb.eu.mailgun.org.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comDMARC policy on the ORGANIZATIONAL domain (not the mg subdomain) — one per domain. Start at p=none.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Mailgun's setup costs against that budget.

SPF 10-lookup budget5 used · 5 free

Mailgun adds 5 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

Mailgun offers two DKIM methods and the choice only affects DKIM, never SPF. The recommended path is Automatic Sender Security: enable it when adding the domain and Mailgun hands you two CNAME records (the labels are shown per-account, e.g. pdk1._domainkey.mg.yourdomain.com and pdk2._domainkey.mg.yourdomain.com), each pointing to a Mailgun-hosted target on dkim1.mailgun.com that is unique to your account. Because these are CNAMEs delegated to Mailgun, Mailgun holds the private keys, publishes 2048-bit public keys behind those selectors, and rotates them automatically on a schedule it manages (you can also force a rotation any time) — you never copy a key or edit DNS again. Two selectors exist so a new key can be published before the old one retires, with no signing gap. The classic alternative (the default if you leave Automatic Sender Security off) is a single static DKIM TXT record at the selector Mailgun displays — a <selector>._domainkey.mg.yourdomain.com host — holding k=rsa; p=<long base64 public key>. That key is static: rotating it means regenerating in Mailgun and re-editing DNS, and a 2048-bit value frequently exceeds the 255-character single-string TXT limit, so you'll need to split it into two quoted strings (Mailgun shows the split). Either way the DKIM d= is your sending subdomain, which aligns relaxed to your organizational domain so DMARC passes.

DMARC

DMARC is a separate TXT record and is not one of the records Mailgun generates. Publish it once at _dmarc.yourdomain.com on your organizational (root) domain — not on the mg subdomain — starting with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none is monitor-only, so it won't affect delivery while you confirm Mailgun mail is passing SPF and DKIM aligned to your domain. DMARC alignment works here even when your visible From is you@yourdomain.com and Mailgun signs with d=mg.yourdomain.com, because relaxed alignment treats a subdomain and its parent as the same organizational domain (and Mailgun's Return-Path lives on the same sending subdomain, so SPF aligns too). Because a DMARC record on the root also covers subdomains, your existing _dmarc record already governs mg.yourdomain.com; only add a subdomain-specific policy (via sp= on the root record, or a dedicated _dmarc.mg record) if you want the subdomain treated differently. Watch the aggregate (rua) reports for a week or two, then tighten to p=quarantine and eventually p=reject once Mailgun consistently shows as an aligned, passing source. Keep exactly one _dmarc record for the domain no matter how many senders you run.

Check it actually worked

Don't trust the green checkmarks in Mailgun's DNS panel alone — they confirm the records resolve, not that a real message authenticates. Send yourself a test from an address on the verified subdomain (Mailgun has a Send test email button, or use your app), open it in Gmail, and choose the three-dot menu → Show original: you want SPF: PASS and DKIM: PASS both showing your domain, plus DMARC: PASS, and the DKIM signature d= should be mg.yourdomain.com. Run the sending subdomain through Qualisend's domain health check to confirm the SPF, DKIM, and DMARC records all resolve and that the SPF include isn't pushing you over ten lookups, and once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer — Mailgun should appear as an aligned, passing source. Mailgun's own Logs tab will also flag delivery and authentication failures per message.

Domain health check DMARC report analyzer

Common gotchas

DNS setup
include:mailgun.org is heavy — verified live, it resolves to five DNS lookups because a single line covers both regions (mailgun.org → _spf.mailgun.org, which nests _spf1 and _spf2, plus _spf.eu.mailgun.org). That's half of the RFC 7208 ten-lookup budget. Putting Mailgun on its own sending subdomain keeps the include off your root SPF entirely; EU-only senders can narrow to include:_spf.eu.mailgun.org (one lookup).
Coverage
US vs EU regions are separate: EU domains are managed at app.eu.mailgun.com and their tracking/MX records point at eu.mailgun.org hosts. Copying records from the wrong region — or logging into the wrong dashboard — means the domain never verifies.
Coverage
The sandbox domain (sandboxXXXX.mailgun.org) is test-only: it sends to a handful of pre-authorized recipients and builds no reputation. Never use it in production — add and verify your own domain.
Coverage
Don't repoint your root MX at Mailgun if Google Workspace or Microsoft 365 hosts your mailboxes — it will break inbound mail. Use a dedicated subdomain for Mailgun, or skip MX altogether for send-only sending.
DNS setup
2048-bit DKIM TXT length: a single long p= string often exceeds the 255-character TXT limit and gets rejected or truncated. Split it into two quoted strings exactly as Mailgun shows. Automatic Sender Security's CNAMEs avoid this problem entirely.
DNS setup
Cloudflare proxy breaks CNAMEs: set the DKIM _domainkey CNAMEs and the email tracking CNAME to DNS only (grey cloud). An orange-cloud proxied record won't resolve to Mailgun and verification fails.
Breaks auth
Keep one SPF TXT per host: if the sending subdomain already has an SPF record, merge include:mailgun.org into it rather than adding a second SPF TXT — two SPF records on one host is a PermError that fails SPF outright.
DNS setup
Host-field doubling: many registrars auto-append your domain, so typing mg.yourdomain.com yields mg.yourdomain.com.yourdomain.com. Enter just the label the panel expects (mg, pdk1._domainkey.mg, email.mg).

Build your SPF record

Mailgun is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Mailguninclude:mailgun.orgGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:mailgun.org ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list