Do I need include:mailgun.org, or are the DKIM CNAMEs enough?

Add both — Omnisend's flow gives you the SPF include because Mailgun is its sending backend, so publish it to authorize those IPs. But because Mailgun owns the Return-Path, SPF authorizes without aligning to your domain, so it won't earn a DMARC pass on its own. The DKIM CNAMEs sign as d=yourdomain.com and are the mechanism that reliably aligns and carries DMARC (and survives forwarding, which SPF doesn't). Set up SPF, both DKIM CNAMEs, and DMARC, and rely on DKIM for alignment.

Why does include:mailgun.org use so many SPF lookups?

Because it nests Mailgun's entire regional SPF tree. mailgun.org expands to include:_spf.mailgun.org plus include:_spf.eu.mailgun.org, and _spf.mailgun.org further nests include:_spf1.mailgun.org and include:_spf2.mailgun.org. That's 5 DNS lookups from one include — half of the RFC 7208 limit of 10. If you only send from the EU, use include:eu.mailgun.org (2 lookups) or include:_spf.eu.mailgun.org (1) to reclaim room.

Is Omnisend's DKIM a CNAME or a TXT record?

CNAMEs — two of them. Omnisend gives you a pair of CNAME records with account-specific selectors (the label before ._domainkey) that delegate the keys back to Omnisend/Mailgun, so they hold the private keys and can rotate them without you editing DNS again. Copy the exact selectors and targets Omnisend shows, keep them as CNAMEs (never TXT), and add both — the second exists so key rotation doesn't break your signing.

SPF shows mailgun.org instead of my domain — is that broken?

No, that's expected. Omnisend sends via Mailgun and processes bounces on a mailgun.org Return-Path, and DMARC checks SPF against that Return-Path — so SPF legitimately reports mailgun.org as the domain it checked. That's the authorize-but-not-align behavior; your DMARC pass comes from aligned DKIM (d=yourdomain.com). The only real red flag is DKIM signing as a Mailgun/Omnisend domain rather than yours, which means the CNAMEs haven't taken effect.

Can I send campaigns from a gmail.com or yahoo.com address?

No — send from your own authenticated domain. You can't DKIM-sign or SPF-align a domain you don't own, so a From address on a free public domain fails DMARC alignment: Yahoo publishes p=reject and drops it, and Gmail strictly polices spoofing of gmail.com, so it bounces or lands in spam. Since February 2024 Gmail and Yahoo require aligned authentication from bulk senders, so this is enforced, not optional.

I already send with Shopify and Google Workspace — how do I combine SPF?

One SPF record only. Merge include:mailgun.org into your existing v=spf1 line rather than adding a second SPF TXT record (two is a PermError). Because include:mailgun.org alone costs 5 of the 10 allowed lookups, stacking it with Google Workspace and others can trip the limit — check your merged record with an SPF checker, and EU-only senders can swap in include:eu.mailgun.org (2 lookups) to reclaim room. DKIM and DMARC are independent: each sender gets its own DKIM records, and there's still just one _dmarc record for the whole domain.

SPF setup guide

SPF, DKIM & DMARC for Omnisend.

Omnisend authenticates your sending domain from Store settings → Domains, not by having you paste one magic line. Because Omnisend runs its email delivery on Mailgun's infrastructure, its flow hands you three things: an SPF record built around include:mailgun.org that you merge into your root SPF, DKIM published as two CNAME records with account-specific selectors that delegate a rotating key pair back to Omnisend, and a DMARC policy record. The SPF include authorizes Mailgun's IPs to send as you; the DKIM CNAMEs sign mail as d=yourdomain.com so it aligns for DMARC. Once all three resolve and the Domains page flips to Verified, Omnisend sends fully as your own domain instead of leaning on its shared, unbranded sending identity.

SPF include

Your DNSAdd the CNAME / TXT records

OmnisendSigns & sends as your domain

The inboxSPF · DKIM · DMARC pass

Why authenticate Omnisend?

For an e-commerce sender, authenticating your Omnisend domain is the difference between the promo tab and the spam folder — and it's effectively mandatory now. Since February 2024, Gmail and Yahoo require every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail into Outlook/Hotmail/Live in 2025. Omnisend accounts routinely blow past 5,000/day the first time an abandoned-cart or newsletter blast goes out, so you are squarely a bulk sender in the eyes of those mailbox providers. Until you authenticate, Omnisend sends mail that isn't cryptographically yours: your From address doesn't align, DMARC can't pass, and your reputation is pooled with every other unauthenticated sender on the shared infrastructure. Worse, you can't reliably run Omnisend campaigns from a free public From address such as gmail.com or yahoo.com: you don't control those domains' DKIM keys, so the mail can't align and pass DMARC — Yahoo publishes p=reject and rejects it outright, while Gmail strictly polices spoofing of gmail.com, so it lands in spam or bounces. Authenticating your own domain aligns DKIM to you, lets DMARC pass, removes the shared-sender penalty, and means the sending reputation you build with every campaign accrues to your brand.

The SPF reality for Omnisend

Omnisend is a genuine "include" provider — its Domains flow generates a real SPF line, v=spf1 include:mailgun.org ~all, and asks you to publish it on your root domain — because Omnisend sends through Mailgun and include:mailgun.org is the shared mechanism that authorizes Mailgun's sending IPs. Add it. But two things make this SPF unusual, and both matter. First, the alignment caveat: Omnisend/Mailgun processes your bounces on its own Return-Path (envelope-from) domain on mailgun.org, and DMARC checks SPF alignment against that Return-Path, not your visible From address. So this SPF record can raw-"pass" while aligning to Mailgun's domain rather than yours — which means SPF alone does NOT earn you a DMARC pass. That is exactly why Omnisend's flow also gives you DKIM as CNAMEs: DKIM signed as d=yourdomain.com is the mechanism that actually aligns and carries DMARC (and, unlike SPF, it survives forwarding). Set up both, but rely on DKIM for your DMARC pass. Second, the cost: include:mailgun.org is expensive. It nests the entire Mailgun chain — mailgun.org resolves to include:_spf.mailgun.org plus include:_spf.eu.mailgun.org; _spf.mailgun.org in turn nests include:_spf1.mailgun.org and include:_spf2.mailgun.org — so a single include:mailgun.org consumes 5 of your 10 allowed SPF DNS lookups (RFC 7208). If you also send through Google Workspace, Microsoft 365, Klaviyo, or a help-desk tool, you can hit the 10-lookup PermError fast, so plan the merge carefully. EU-only senders can narrow the cost with include:eu.mailgun.org (2 lookups) or include:_spf.eu.mailgun.org (1 lookup) instead of the full US+EU include. And there must be exactly one SPF TXT record on the domain — merge Mailgun's include into your existing v=spf1 line rather than publishing a second SPF record (two SPF records is itself a PermError). Helpfully, if Omnisend detects an existing SPF record it tries to auto-merge include:mailgun.org for you and shows the single combined line to paste — but always confirm the result stays under 10 lookups.

Step by step

In Omnisend

1
Open the Domains page
Log in to Omnisend and go to Store settings → Domains (open the store name/settings menu, then Domains). Sending-domain authentication lives here — you add and verify the domain, then publish the records it generates at your DNS host.
2
Add your sending domain
Click + Add domain, choose the Email domain type, and enter the domain you send campaigns from (e.g. yourdomain.com — use the same organizational domain as your From address so DKIM aligns). Omnisend generates the SPF, DKIM, and DMARC records for that specific domain.
3
Select your DNS provider and copy the records
Pick your DNS host from the dropdown so Omnisend tailors the on-screen instructions (it does not log in and add records for you — you paste them yourself). Omnisend then shows an SPF TXT value (v=spf1 include:mailgun.org ~all), two DKIM CNAME records with account-specific selectors, and a starter DMARC TXT record. Copy them exactly — the DKIM selectors and targets are unique to your account.

In your DNS

4
Publish or merge the SPF record
At your DNS host, add a TXT record on the root (host @ or blank) with v=spf1 include:mailgun.org ~all. If a v=spf1 record already exists (Google Workspace, Microsoft 365, Shopify, another ESP), do NOT create a second one — merge include:mailgun.org into the single existing record (Omnisend often pre-merges it for you if it can read your current SPF). Watch your total: include:mailgun.org alone costs 5 of the 10 allowed DNS lookups.
5
Add both DKIM CNAMEs
Create both DKIM CNAME records Omnisend shows — it issues a pair (a key-rotation pair), each with an exact selector (the label before ._domainkey) pointing to the exact target Omnisend gives you. This is the DMARC-aligned mechanism, so get it right: keep the type as CNAME (not TXT), don't add spaces, and don't split or edit the value. Add both, or DKIM will break when Omnisend rotates keys.
6
Add the DMARC record
Omnisend generates a starter DMARC policy — add it as a TXT record at host _dmarc with a value like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Omnisend's generated value is a p=none placeholder (monitor-only) with relaxed alignment, the DMARC default; publish it as-is to start, since your DMARC pass will ride on aligned DKIM, not SPF. Keep exactly one _dmarc record per domain — skip this if you already have one.
7
Fix host doubling and the Cloudflare proxy
Many registrars auto-append your domain, so entering selector._domainkey.yourdomain.com becomes …yourdomain.com.yourdomain.com — enter just the label if the panel adds the domain for you (GoDaddy is the exception and wants the full selector including ._domainkey). If your DNS is behind Cloudflare, set both DKIM CNAMEs to 'DNS only' (grey cloud) — an orange-cloud proxied CNAME won't resolve to Omnisend's target and verification fails.

Verify

8
Verify in Omnisend
Back on the Domains page, click Finish verification. The status moves through In progress / Unverified to Verified, and Omnisend emails you when it's done. Note that Omnisend can verify on any one valid record, so don't stop at the green badge — confirm all three took. Propagation is usually about 30 minutes but can take up to 48 hours. If your domain is already in use under an older setup, the page may ask you to contact Support to finalize — otherwise it's fully self-serve.
9
Send a test and confirm alignment
Make sure your audiences, forms, and automations use a From address on the authenticated domain (verifying DNS doesn't change a campaign already set to a different From). Send a test to a Gmail account, open it, and choose ⋮ → Show original: you want DKIM: PASS with d=yourdomain.com and DMARC: PASS. SPF may show mailgun.org as the checked domain — that's the authorize-but-not-align behavior, which is fine as long as aligned DKIM is carrying DMARC.

Records to add

Omnisend generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

Type	Host	Value
TXT	@	v=spf1 include:mailgun.org ~allRoot SPF — keep exactly ONE SPF record and merge include:mailgun.org into it. Costs 5 DNS lookups (the full Mailgun chain), so mind the 10-lookup limit. EU-only senders can use include:eu.mailgun.org (2 lookups) or include:_spf.eu.mailgun.org (1) instead.
CNAME	s1._domainkey	s1.dkim.omnisend-mailgun.example (illustrative)DKIM record 1 of 2 — Omnisend generates the exact selector and target per domain on the Domains page. Copy verbatim; don't switch the type to TXT, add spaces, or edit the value. This is the DMARC-aligned DKIM signature (d=yourdomain.com).
CNAME	s2._domainkey	s2.dkim.omnisend-mailgun.example (illustrative)DKIM record 2 of 2 — the second selector is the key-rotation pair. Add both, or signing breaks when Omnisend rotates keys. Exact selector and target come from your Omnisend Domains page.
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comAdd this yourself from Omnisend's placeholder value. Starts at p=none (monitor-only) with relaxed alignment (the default). One DMARC record per domain; tighten to quarantine/reject once DKIM is passing aligned.

Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Omnisend's setup costs against that budget.

SPF 10-lookup budget5 used · 5 free

Omnisend adds 5 of your 10 lookups; ip4: and ip6: mechanisms are free.

DKIM

DKIM is the part of Omnisend authentication that actually carries your DMARC pass, so it's the record to get exactly right. Because Omnisend runs on Mailgun and bounces mail through its own Return-Path domain on mailgun.org, SPF (include:mailgun.org) authorizes the send but aligns to Mailgun's domain rather than yours — DKIM is what signs mail as d=yourdomain.com and aligns to your organizational domain. Omnisend publishes DKIM as CNAME records, not TXT records you paste: you add two CNAMEs, each whose host is an account-specific selector (the label before ._domainkey — Omnisend shows the exact ones) pointing to a target Omnisend generates for your account. Because they're CNAMEs delegated back to Omnisend/Mailgun, they hold the private keys and can rotate the published key behind those selectors without you ever re-editing DNS — that's why there are two: a rotation pair. Add both, and copy each selector and target verbatim — do not switch the type to TXT, add spaces, split the value, or 'clean it up.' Two host-field gotchas: most registrars auto-append your domain, so enter just the selector label unless the panel doesn't add it; GoDaddy is the exception and wants the full selector including ._domainkey. If your DNS is proxied by Cloudflare, set the records to DNS only (grey cloud) or they won't resolve. Only once both CNAMEs resolve and Omnisend shows the domain Verified does mail start signing as your domain and DKIM begin aligning.

DMARC

DMARC is a separate policy record on your domain. Omnisend generates a starter value for you, but you publish it yourself at _dmarc.yourdomain.com — begin with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Omnisend's generated record is a p=none placeholder, deliberately tuned to satisfy Gmail's and Yahoo's bulk-sender requirements while you monitor. p=none is monitor-only: it changes nothing about delivery while you collect aggregate (rua) reports and confirm Omnisend mail is passing DKIM aligned to your domain. Note that your DMARC pass here rides on DKIM, not SPF: because Omnisend's Return-Path stays on mailgun.org, SPF won't align to your domain no matter how you set alignment — the aligned DKIM signature (d=yourdomain.com) is what makes DMARC pass. Leave alignment relaxed (the DMARC default). Watch the reports for a week or two, make sure every legitimate sender (Omnisend plus Shopify, Google Workspace, a help desk, etc.) is authenticating, then ramp the policy to p=quarantine and eventually p=reject to actually protect your domain from spoofing. Keep exactly one _dmarc record for the whole organizational domain no matter how many senders you use — never add a second DMARC record specifically for Omnisend.

Check it actually worked

Don't trust the Domains page's Verified badge alone — Omnisend can flip a domain to Verified on just one valid record, so confirm it on a real message. Send a test campaign or email to a Gmail account from an address on the authenticated domain, open it, and choose ⋮ → Show original. You want DKIM: PASS with signed-by / d=yourdomain.com and DMARC: PASS. The SPF line may show mailgun.org as the domain it checked — that's expected (Mailgun owns the Return-Path), and it's fine as long as aligned DKIM is carrying the DMARC pass; the failure to watch for is DKIM signing as a Mailgun/Omnisend domain instead of yours, which means the CNAMEs haven't taken effect. You can spot-check the raw records with dig TXT yourdomain.com (SPF), dig CNAME s1._domainkey.yourdomain.com (DKIM, using your real selectors — check both), and dig TXT _dmarc.yourdomain.com. Then run the domain through Qualisend's domain health check to confirm every record resolves and your merged SPF is still under the 10-lookup limit — important, since include:mailgun.org alone eats 5 lookups. Once DMARC aggregate reports start arriving, drop one into the DMARC report analyzer; Omnisend/Mailgun should appear as an aligned, passing source.

Domain health check DMARC report analyzer

Common gotchas

Breaks auth
include:mailgun.org is expensive: it nests the whole Mailgun chain (mailgun.org → _spf.mailgun.org → _spf1/_spf2, plus _spf.eu.mailgun.org) and costs 5 of your 10 allowed SPF DNS lookups — half the RFC 7208 limit. Stack it with Google Workspace/Microsoft 365/another ESP and you can hit a PermError. EU-only senders can narrow to include:eu.mailgun.org (2 lookups) or include:_spf.eu.mailgun.org (1).
DNS setup
SPF authorizes but doesn't align. Omnisend/Mailgun bounces through its own mailgun.org Return-Path, and DMARC checks SPF against the Return-Path domain — so this record can raw-pass while aligning to mailgun.org, not you. DKIM (the CNAMEs, d=yourdomain.com) is the mechanism that actually carries DMARC. Never skip it thinking SPF is enough.
DNS setup
Don't modify the DKIM CNAMEs — and don't drop the second one. Omnisend gives you two CNAMEs; copy both selectors and targets exactly, keep them CNAME (not TXT), don't add spaces, split, or 'tidy' the value. A single altered character breaks signing, and omitting the second CNAME breaks signing on Omnisend's next key rotation.
DNS setup
Cloudflare proxy breaks the DKIM CNAMEs: set both to 'DNS only' (grey cloud). An orange-cloud proxied CNAME won't resolve to Omnisend's target and verification fails.
DNS setup
Host-field doubling: registrars that auto-append your domain turn s1._domainkey into s1._domainkey.yourdomain.com.yourdomain.com. Enter just the label — except GoDaddy, which wants the full selector including ._domainkey.
Breaks auth
Keep exactly one SPF TXT record on the root. If you already send via Shopify, Google Workspace, Microsoft 365, etc., merge include:mailgun.org into that single v=spf1 line — two SPF records is a PermError.
DNS setup
You can't send from a free public From address. You don't control the DKIM keys for gmail.com, yahoo.com, or outlook.com, so an Omnisend campaign 'from' one fails DMARC alignment — Yahoo publishes p=reject and drops it, and Gmail strictly polices spoofing of its own domain. Send from your authenticated custom domain instead.
Coverage
Verifying DNS doesn't change existing campaigns. Set the From address on your audiences, forms, and automations to the authenticated domain, or mail keeps going out under the old, unaligned identity.

Build your SPF record

Omnisend is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Sending sources

Search for each platform you send email through and tick it.

Selected

Omnisendinclude:mailgun.orgGuide →

This domain's own servers

Authorize the domain itself, if it sends mail directly (not through a platform above).

a — the domain's own A recordmx — the domain's MX hosts

Other senders & IPs

Anything not in the list — another provider's SPF host, or specific IP addresses.

Additional includes

We add the include: prefix — enter the hostname your provider documents.

IPv4 addresses

IPv6 addresses

Policy for everyone else

What receivers should do with mail from any server not listed above (the all mechanism).

-all (fail)Strict — receivers should reject mail from any server not listed.~all (softfail)Recommended default — unlisted senders are accepted but marked suspicious.?all (neutral)No opinion — provides almost no protection; use only while testing.

Your SPF record1/10 DNS lookups

v=spf1 include:mailgun.org ~all

Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.

Authentication published? The next step is sending to a clean, verified list.

Verify a list