Guides › Providers
SPF, DKIM and DMARC for Mailgun
SPF
Mailgun recommends sending from a subdomain (for example mg.yourdomain.com). Publish SPF on that subdomain:
Host: mg Type: TXT Value: v=spf1 include:mailgun.org ~all
DKIM
Mailgun gives you a TXT record at a selector such as pic._domainkey.mg.yourdomain.com or mx._domainkey.mg; the selector varies. Copy it from Sending › Domains › DNS records. To check it here, enter the subdomain (mg.yourdomain.com) and the selector.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Notes
DMARC on the root domain covers subdomains unless you set sp=. Alignment is "relaxed" by default, so mail signed by mg.yourdomain.com aligns with yourdomain.com.
Use the checker to confirm all three records. It detects Mailgun's DKIM selector automatically if it's a standard one.