--- title: "AutoSPF’s Complete Guide to Setting Up Mailgun SPF & DKIM for Reliable Email Delivery" description: "Deliverability is one of the most critical challenges any modern business faces when sending email at scale." image: "https://autospf.com/og/blog/complete-guide-to-setting-up-mailgun-spf-and-dkim.png" canonical: "https://autospf.com/blog/complete-guide-to-setting-up-mailgun-spf-and-dkim/" --- Quick Answer Deliverability is one of the most critical challenges any modern business faces when sending email at scale. Whether you’re sending transactional emails like password resets or critical alerts, or delivering newsletters and marketing messages, every email you send must be authenticated correctly, or it may be treated as spam or rejected entirely. ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fcomplete-guide-to-setting-up-mailgun-spf-and-dkim%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=AutoSPF%E2%80%99s%20Complete%20Guide%20to%20Setting%20Up%20Mailgun%20SPF%20%26%20DKIM%20for%20Reliable%20Email%20Delivery&url=https%3A%2F%2Fautospf.com%2Fblog%2Fcomplete-guide-to-setting-up-mailgun-spf-and-dkim%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fcomplete-guide-to-setting-up-mailgun-spf-and-dkim%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fcomplete-guide-to-setting-up-mailgun-spf-and-dkim%2F&title=AutoSPF%E2%80%99s%20Complete%20Guide%20to%20Setting%20Up%20Mailgun%20SPF%20%26%20DKIM%20for%20Reliable%20Email%20Delivery "Share on Reddit") [ ](mailto:?subject=AutoSPF%E2%80%99s%20Complete%20Guide%20to%20Setting%20Up%20Mailgun%20SPF%20%26%20DKIM%20for%20Reliable%20Email%20Delivery&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fcomplete-guide-to-setting-up-mailgun-spf-and-dkim%2F "Share via Email") ![Reliable Email Delivery](https://media.mailhop.org/autospf/images/2025/12/kitterman-spf-0994.jpg) Deliverability is one of the most critical challenges any **modern business faces** when sending email at scale. _Whether you’re sending transactional emails like password resets or critical alerts, or delivering newsletters and marketing messages, every email you send must be authenticated correctly, or it may be treated as spam or rejected entirely_. At [AutoSPF](/), we’ve helped countless teams harden their email infrastructure using proper authentication standards. In this guide, we’re going to walk you step-by-step through **configuring Mailgun**, one of the most popular email delivery services, with SPF and DKIM records. Along the way we’ll explain why each of these technologies matters, how they work together, and best practices for getting the most out of your [email authentication](/blog/why-email-authentication-rules-are-stricter-for-bulk-senders/) setup. ## Why Mailgun? Why SPF and DKIM Matter Mailgun is a **powerful API-based** email delivery provider trusted by thousands of developers and businesses worldwide. It’s particularly valuable if you’re building applications that need robust, programmatic email sending, from welcome messages to eCommerce receipts. However, even the best email delivery APIs won’t ensure that your messages reach inboxes unless you’ve authenticated your sending domain. That’s where **SPF** (Sender Policy Framework) and **DKIM** (DomainKeys Identified Mail) come in. ### What is SPF? SPF is an email authentication protocol that lets domain owners specify which mail servers are **authorized** to send mail on behalf of their domain. This is done by publishing a DNS TXT record that lists the valid sending IP addresses or services. When a receiving [mail server](https://www.activecampaign.com/glossary/mail-server) gets an email from your domain, it checks the DNS for your SPF record. If the server that sent the email isn’t listed, the email fails SPF and could be marked as spam or rejected entirely. Without SPF, it’s easy for spammers or fraudsters to impersonate your domain, a major threat to your brand and your **recipients’ security**. ![mail server](https://media.mailhop.org/autospf/images/2025/12/spf-record-checker-0447.jpg) ### What is DKIM? DKIM works differently but toward the same goal of authentication. Instead of listing approved servers, DKIM uses [public-key cryptography](https://www.encryptionconsulting.com/education-center/what-is-public-key-cryptography/). The sending mail server uses a private key to add a **digital signature** to each outbound message, and the receiving server uses a corresponding public key, published as a DNS record, to verify the signature. If anything in the email has been tampered with since it was signed, the verification will fail, protecting your emails from certain types of [spoofing](https://blog.lastpass.com/posts/email-spoofing-what-hackers-hope-you-miss-in-2025) and ensuring the message integrity. Together, SPF and DKIM are the foundation for **DMARC** (Domain-based Message Authentication, Reporting & Conformance), which we’ll touch on briefly at the end. Proper SPF and DKIM setup is also a requirement for DMARC to work effectively. ## Before You Begin Before jumping into the [DNS configuration](https://www.hivelocity.net/kb/dns-configuration-everything-you-need-to-know/), there are a few things you should understand: 📌 You’ll need access to your domain’s **DNS provider** (where your [DNS records](/blog/how-does-spf-flattening-simplify-dns-records/) are managed, e.g., Cloudflare, GoDaddy, Google Domains, etc.). 📌 Using a **subdomain** for sending (e.g., mg.yourdomain.com instead of yourdomain.com) is strongly recommended. That way, the SPF/DKIM/MX records Mailgun provides won’t intersect with your root domain’s email infrastructure. 📌 Mailgun generates records for you, you don’t need to build them by hand, but you _do_ need to copy them into your [DNS zone](https://www.cloudns.net/blog/master-slave-dns/). 📌 If you already have an existing [SPF record](/blog/spf-records-benefits-uses-and-generation/) and Mailgun shows you a new SPF string to add, you **do not** create a second SPF TXT record. Instead, you incorporate Mailgun’s information into your existing one. ## Step-by-Step SPF & DKIM Setup for Mailgun ### 1\. Log in to Your Mailgun Account Head over to the **Mailgun control panel and log** in using your credentials. Once you’ve logged in, you should see a dashboard listing your domains and sending activity. ### 2\. Add Your Sending Domain or Subdomain From the sidebar navigation: 👉 Click the **“Sending”** tab 👉 Choose \*\*“Domains”\*\*👉 Click **“Add New Domain”** Here, you’ll enter the domain or subdomain you want to use for sending. Many teams opt for a subdomain like mail.yourdomain.com or mg.yourdomain.com to avoid conflicts with standard email routing. Why a subdomain? Because Mailgun will give you MX, SPF, DKIM, and [CNAME records](https://support.dnsimple.com/articles/cname-record/) that _must_ not conflict with your root domain’s mail service, using a dedicated subdomain keeps things clean and predictable. ### 3\. Review the DNS Records Provided by Mailgun Once the domain is saved, Mailgun will display several DNS records you need to add. These typically include: ✔ An **SPF value** (often something like: v=spf1 include:mailgun.org \~all) ✔ One or more **DKIM records** (TXT or CNAME format) ✔ **MX** records (optional depending on your routing) ✔ A **tracking CNAME** record (for click tracking functionality) Every DNS host has slightly different UI, but the data you copy is the same. ![email spam](https://media.mailhop.org/autospf/images/2025/12/spf-record-syntax-0224.jpg) ### 4\. Log in to Your DNS Provider Now go to the service where your DNS is managed. If you use **Cloudflare**, **GoDaddy**, **Google Domains**, **Namecheap**, or others, you’ll find a section called something like **“DNS Management”** or **“DNS Zone Editor”**. In Cloudflare, for example, you can find your DNS records under **DNS** in the sidebar. ### 5\. Add the SPF Record If you **don’t have an existing SPF record**, create a new **TXT** record with the SPF value Mailgun provided. It typically looks like: v=spf1 include:mailgun.org \~all This tells receiving mail servers that any IP in Mailgun’s sending range is authorized to send mail for your domain. If you **already have an SPF record**, you _must not_ create another TXT record. Instead, add Mailgun’s include to your existing one. For example: v=spf1 include:existing-service.com include:mailgun.org \~all That way you still have only one SPF TXT record. ⚠ Important: DNS needs time to propagate, typically up to 24 hours, but often much sooner once cached globally. ### 6\. Add the DKIM Records Mailgun will provide [DKIM](/blog/complete-guide-to-setting-up-freshmail-dkim-and-spf-records/) information that may be a TXT or CNAME record. Many DNS panels allow you to paste long key strings directly; others may require special formatting. A DKIM record usually includes: - A **selector** (e.g., default.\_domainkey) - The **public key** which the receiving mail server will use to verify signatures These records are essential, without them, Mailgun’s DKIM signature can’t be validated when the email reaches inboxes. ![Email spoofing](https://media.mailhop.org/autospf/images/2025/12/spf-validator-0665.jpg) ### 7\. Add Any MX and CNAME Records If Mailgun instructed you to add [MX records](https://www.cloudns.net/wiki/article/12/) for handling inbound mail or **CNAMES** for tracking, make sure to add those exactly as provided. For example, a tracking CNAME ensures click and open tracking works properly if you’re using Mailgun’s analytics. Mailgun’s web UI will tell you exactly what fields to set. These entries are crucial for verification. ### 8\. Turn off Proxy/Cloudflare Orange Cloud (if applicable) If your DNS provider supports proxying (e.g., the orange cloud in Cloudflare), be sure to **turn that off** for your Mailgun records. Proxied DNS entries can break SPF/DKIM verification because the receiving mail servers can’t see the actual DNS values. ### 9\. Verify Within Mailgun After you’ve added all the records in your DNS provider: 👉 Return to the Mailgun dashboard 👉 Click **“Verify [DNS Settings](https://www.ntchosting.com/encyclopedia/dns/settings/)”** Mailgun will look up the DNS entries and confirm whether SPF, DKIM, and other records are correct. When everything is properly configured, you should see **green checkmarks** beside each item. If something doesn’t validate immediately, don’t panic, [DNS propagation](https://www.ibm.com/think/topics/dns-propagation) can take some time. Wait, then verify again. ## Troubleshooting and Best Practices ### DNS Propagation Takes Time Even if you did everything correctly, DNS changes don’t take effect everywhere instantly. Most **DNS providers propagate** within minutes to hours, but some may take up to 24 hours. ### Only One SPF TXT Record Remember, multiple SPF records for the same domain will cause SPF to fail completely. Always merge includes into the existing record. ### **Key Length Choices for DKIM** Mailgun allows two DKIM key lengths: **1024-bit** or **2048-bit**. A 2048-bit key is more secure but longer and occasionally harder to paste into some DNS panels because of size limits. ![Email authentication](https://media.mailhop.org/autospf/images/2025/12/spf-permerror-0991.jpg) ## Once DNS is Verified, What Next? ### DMARC SPF and DKIM are prerequisites for setting up a DMARC policy. DMARC builds on these two protocols and lets you specify how receivers should handle mail that fails authentication, whether to quarantine it, reject it, or none at all. A DMARC record also lets you receive reports so you can monitor authentication performance and troubleshoot domains that are failing. ### Monitor Deliverability Tools like **DMARC reporting services** can help you understand whether your emails are authenticating correctly and whether recipients are accepting your messages. ## Topics [ DKIM ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ SPF ](/tags/spf/)[ SPF record ](/tags/spf-record/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 6m 6 Best practices for maintaining an SPF record Jun 5, 2025 ](/blog/6-best-practices-for-maintaining-an-spf-record/)[ Intermediate 3m Adding your SPF record to your domain provider Sep 2, 2024 ](/blog/adding-your-spf-record-to-your-domain-provider/)[ Intermediate 5m Are Your SPF and DKIM Identifiers Aligned? Jul 18, 2024 ](/blog/are-your-spf-and-dkim-identifiers-aligned/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"AutoSPF’s Complete Guide to Setting Up Mailgun SPF & DKIM for Reliable Email Delivery","description":"Deliverability is one of the most critical challenges any modern business faces when sending email at scale.","url":"https://autospf.com/blog/complete-guide-to-setting-up-mailgun-spf-and-dkim/","datePublished":"2025-12-23T15:44:41.000Z","dateModified":"2025-12-23T15:44:44.000Z","dateCreated":"2025-12-23T15:44:41.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/complete-guide-to-setting-up-mailgun-spf-and-dkim/"},"articleSection":"intermediate","keywords":"DKIM, DMARC, SPF, SPF record","wordCount":1457,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2025/12/kitterman-spf-0994.jpg","caption":"Reliable Email Delivery","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"AutoSPF’s Complete Guide to Setting Up Mailgun SPF & DKIM for Reliable Email Delivery","item":"https://autospf.com/blog/complete-guide-to-setting-up-mailgun-spf-and-dkim/"}]} ```