DMARC for email delivery services
How do I set up DMARC for Mailgun?
Mailgun verifies a sending domain with an SPF TXT record, a DKIM record from its control panel (TXT, or CNAME with Automatic Sender Security), two MX records and a tracking CNAME.
The DNS records for Mailgun
SPF: TXT on the domain you added to Mailgun
v=spf1 include:mailgun.org ~allIf that domain already has an SPF record, merge the include into it.
DKIM selector: Shown per domain in the Mailgun control panel
<selector>._domainkey.<your sending domain> TXT or CNAME (type and value from Domain Verification & DNS)Mailgun's page does not give a fixed selector, so copy it from your panel and use that value in the DKIM check.
MX, priority 10
mxa.mailgun.orgMX, priority 10
mxb.mailgun.orgTracking CNAME
email.<your sending domain> CNAME mailgun.org (EU domains: eu.mailgun.org)Values in angle brackets are specific to your account. Copy the real ones from Mailgun rather than from this page.
Alignment caveats
- ✓The MX records route inbound mail for that domain to Mailgun. Publishing them on a domain that already receives mail would redirect it, so use a dedicated subdomain.
- ✓Mail sent from a subdomain must also carry a From address on that domain, or under the same organizational domain, to align.
- ✓EU-region domains use different values: mxa.eu.mailgun.org and mxb.eu.mailgun.org. Copy yours from the control panel.
From p=none to p=reject with Mailgun
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Make sure your From address is on the verified Mailgun domain or its parent, then confirm the aligned pass in your reports.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from Mailgun's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how Mailgun really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does Mailgun need?
v=spf1 include:mailgun.org ~all, published as: TXT on the domain you added to Mailgun. If that domain already has an SPF record, merge the include into it.
What DKIM selector does Mailgun use?
Shown per domain in the Mailgun control panel. Mailgun's page does not give a fixed selector, so copy it from your panel and use that value in the DKIM check.
Will Mailgun mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. The MX records route inbound mail for that domain to Mailgun. Publishing them on a domain that already receives mail would redirect it, so use a dedicated subdomain.
How do I reach p=reject with Mailgun?
Start at p=none with a rua address, finish the Mailgun setup, then read your reports. Make sure your From address is on the verified Mailgun domain or its parent, then confirm the aligned pass in your reports. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
