Mailgun DMARC Setup: Configure DMARC for Mailgun Email

Email Authentication

If you're sending email through Mailgun without a DMARC record, receiving servers have no way to verify that your messages are legitimately from your domain. Setting up DMARC with Mailgun requires three things: SPF, DKIM, and a DMARC DNS record. Here's how to get all three working together.

What You Need Before Starting

Before configuring DMARC, confirm you have:

• A custom sending domain in Mailgun — not the default sandbox domain
• DNS access for the domain you send from
• SPF and DKIM configured in Mailgun (covered below if not done yet)

Step 1: Set Up Your Custom Domain in Mailgun

If you're still using Mailgun's sandbox domain, switch to your own domain first.

1. In the Mailgun dashboard, go to Sending → Domains
2. Click Add New Domain
3. Enter your sending domain (e.g., mail.yourdomain.com or yourdomain.com)
4. Choose your region (US or EU)
5. Mailgun generates the DNS records you need

Step 2: Configure SPF for Mailgun

Mailgun provides an SPF record to add to your DNS. The exact record depends on whether you're using a subdomain or root domain.

For a subdomain (e.g., mail.yourdomain.com):

Add a TXT record for mail.yourdomain.com:

v=spf1 include:mailgun.org -all

For your root domain:

If you already have an SPF record, add Mailgun's include to it:

v=spf1 include:_spf.google.com include:mailgun.org -all

Don't create a second SPF record — merge into your existing one.

Verify with: SPF Record Check — enter your sending domain and confirm Mailgun is included.

Step 3: Configure DKIM for Mailgun

Mailgun signs emails with DKIM automatically, but you need to add their DKIM public key to your DNS so receivers can verify the signature.

1. In Mailgun's domain settings, find the DKIM section
2. Mailgun provides a TXT record (or CNAME, depending on your setup)
3. Add the record to your DNS

The record typically looks like:

Name: smtp._domainkey.yourdomain.com (or the subdomain)

Value: A long TXT record starting with k=rsa; p=...

Some Mailgun configurations use CNAME records instead — follow what Mailgun's dashboard provides for your specific domain.

Verify with: DKIM Test — send a test email and check that DKIM passes with your domain.

Step 4: Create Your DMARC Record

Now that SPF and DKIM are configured, add a DMARC record. This is a TXT record at _dmarc.yourdomain.com.

Start with monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Add this DNS record:

• Type: TXT
• Name: _dmarc (your DNS provider may show this as _dmarc.yourdomain.com)
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Step 5: Verify DMARC Alignment

DMARC doesn't just check that SPF or DKIM pass — it checks alignment: the authenticated domain must match the From header domain.

With Mailgun, alignment works when:

• DKIM alignment: Mailgun signs with d=yourdomain.com (or your subdomain), matching your From address
• SPF alignment: The envelope sender (Return-Path) domain matches your From domain

If you're sending from user@yourdomain.com and Mailgun signs DKIM as d=yourdomain.com, DMARC passes.

If you're using a subdomain:

Sending from user@yourdomain.com with DKIM signed as d=mail.yourdomain.com works with relaxed alignment (the default). The subdomain aligns with the root domain.

Sending from user@mail.yourdomain.com with DKIM signed as d=mail.yourdomain.com works with both relaxed and strict alignment.

Test the Full Chain

Send a test email to a Gmail or Outlook account and check the headers:

1. Open the email
2. View the original message / headers
3. Look for the Authentication-Results header

You want to see:

dkim=pass header.d=yourdomain.com
spf=pass
dmarc=pass

If DMARC shows fail, check which part failed — SPF alignment, DKIM alignment, or both.

Step 6: Enforce Your DMARC Policy

After monitoring for 2-4 weeks and confirming all legitimate email passes, tighten the policy:

Quarantine (sends failures to spam):

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Reject (blocks failures entirely):

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

Move from none → quarantine → reject gradually. Check your DMARC reports at each stage.

Common Mailgun DMARC Issues

DMARC Fails Despite Mailgun DKIM Being Set Up

Cause: The From address domain doesn't match the DKIM signing domain.

Fix: Ensure your Mailgun sending domain matches the domain in your From header. If you configured mail.yourdomain.com in Mailgun but send as user@yourdomain.com, DKIM alignment relies on relaxed mode. Check that your DMARC record doesn't have adkim=s (strict).

SPF Passes but DMARC Still Fails

Cause: SPF alignment failure. Mailgun's envelope sender (Return-Path) doesn't match your From domain.

Fix: In Mailgun, configure your custom Return-Path / bounce domain. Go to your domain settings and set up the tracking/bounce CNAME records Mailgun provides.

Multiple Sending Services

If you also send email from Google Workspace, Microsoft 365, or other services alongside Mailgun:

1. SPF: Include all services in one SPF record
2. DKIM: Configure DKIM signing in each service
3. DMARC: One DMARC record covers all senders — it checks alignment regardless of which service sent the email

v=spf1 include:_spf.google.com include:mailgun.org -all

Each service needs its own DKIM key, but they can all use different selectors on the same domain.

Mailgun Subaccount / Multiple Domains

If you send from multiple domains through Mailgun, each domain needs its own:

• SPF record (on that domain)
• DKIM record (on that domain)
• DMARC record (on that domain)

There's no way to share authentication across domains.

Mailgun-Specific DNS Records Checklist

For a domain yourdomain.com (or subdomain mail.yourdomain.com), you need:

Verify Everything

After setup, verify your full authentication chain:

• Check SPF — confirms Mailgun is in your SPF record
• Check DKIM — confirms DKIM signing works
• Check DMARC — confirms your DMARC record is published and valid
• Check Deliverability — runs all checks at once

Stop Worrying About Email Authentication

The Email Deliverability Suite monitors your SPF, DKIM, DMARC, MX records and blacklist status daily. Get alerts when something breaks — before your Mailgun emails start bouncing.