--- title: "Mailgun DMARC Setup Guide: Configuring SPF, DKIM, And DMARC Correctly | AutoSPF" description: "Learn how to configure Mailgun SPF, DKIM, and DMARC correctly to improve email authentication, deliverability, and domain security." image: "https://autospf.com/og/blog/mailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly.png" canonical: "https://autospf.com/blog/mailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly/" --- Quick Answer To set up DMARC with Mailgun, configure SPF and DKIM records for your sending domain, then publish a DMARC record. Proper alignment improves email authentication, boosts deliverability, and helps protect your domain from spoofing and phishing attacks. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fmailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Mailgun%20DMARC%20Setup%20Guide%3A%20Configuring%20SPF%2C%20DKIM%2C%20And%20DMARC%20Correctly&url=https%3A%2F%2Fautospf.com%2Fblog%2Fmailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fmailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fmailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly%2F&title=Mailgun%20DMARC%20Setup%20Guide%3A%20Configuring%20SPF%2C%20DKIM%2C%20And%20DMARC%20Correctly "Share on Reddit") [ ](mailto:?subject=Mailgun%20DMARC%20Setup%20Guide%3A%20Configuring%20SPF%2C%20DKIM%2C%20And%20DMARC%20Correctly&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fmailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly%2F "Share via Email") ![Mailgun DMARC Setup](https://media.mailhop.org/autospf/dmarc-generator-5863-1782203485932.jpg) DMARC is essential when you send email through Mailgun because it tells [mailbox providers](https://debounce.com/glossary/mailbox-provider-mbp/) how to evaluate messages that claim to come from your domain. For any Mailgun sending domain, DMARC works alongside SPF and DKIM to prove that your email is legitimate and that the visible From address aligns with **authenticated infrastructure**. SPF, or Sender Policy Framework, authorizes specific SMTP servers to send mail for your domain. DKIM, or DomainKeys Identified Mail, adds a [cryptographic signature](https://chainscorelabs.com/glossary/metaverse-standards-and-virtual-assets/content-provenance-and-licensing/cryptographic-signature) that proves the message was not altered in transit. [DMARC](https://autospf.com/blog/from-monitoring-to-enforcement-building-a-scalable-dmarc-strategy/) then checks SPF and DKIM results and, most importantly, verifies alignment between the authenticated domain and the domain shown to recipients. Without DMARC, attackers can **impersonate a domain owner** and send fraudulent messages that appear to come from trusted brands, executives, or applications. That opens the door to email spoofing, [credential theft](https://www.cybersecuritydive.com/news/microsoft-disrupts-global-phishing-credential-theft/760378/), and every common type of phishing attack. For example, a bad actor could impersonate Jane Doe at johndoe.com or send fake billing alerts from superelitebusiness.com if the domain lacks strong email authentication. _DMARC also matters for deliverability and inbox placement_. Google, Yahoo, Gmail, Yahoo Mail, and other ISPs increasingly expect proper email authentication from bulk senders. Google and Yahoo sender requirements include SPF or DKIM authentication, DMARC alignment, and operational practices such as list-unsubscribe and one-click unsubscribe for qualifying senders. If your Mailgun domain setup is incomplete, you may see more [spam placement](https://www.wizbrand.com/tutorials/spam-placement/), deferrals, or a higher [bounce rate](https://www.optimizely.com/optimization-glossary/bounce-rate). ![Email Authentication Triad](https://media.mailhop.org/autospf/spf-checker-5928-1782203525611.jpg) ## Preparing Your Domain and DNS Before Mailgun Authentication Before creating any SPF, DKIM, or DMARC record, confirm which domain will send email. Many teams use a subdomain such as marketing.johndoe.com, mg.johndoe.com, or mail.testdomain.com instead of the root domain. This keeps transactional or marketing traffic separate from corporate email and makes **DNS management easier**. In the Mailgun Control Panel or Mailgun app, add your sending domain and review the [DNS records](https://www.micron.com/about/micron-glossary/dns-records) Mailgun provides. Depending on your account, whether Foundation, Basic, Scale, or a Sinch Mailgun plan with Inbox Placement features, Mailgun will show the required records for authentication, tracking, and routing. You will then publish those records at your DNS provider. Your DNS provider may be Cloudflare, GoDaddy, Route 53, Google Domains, or another registrar/DNS host. The key is to copy values exactly. DNS errors are one of the most common causes of **failed email authentication**. A missing character in a [TXT record](https://www.cloudns.net/wiki/article/14/), an incorrect hostname, or multiple conflicting SPF records can break authentication checks. ### Decide on the Sending Domain and Alignment Model _DMARC alignment compares the domain used by SPF or DKIM with the domain in the visible From address_. For example, if Frodo Baggins sends from [frodo@hobbiton.co.nz](mailto:frodo@hobbiton.co.nz), DMARC expects SPF or DKIM to align with hobbiton.co.nz or an acceptable subdomain. There are two alignment modes: - Relaxed alignment allows **organizational-domain matches**, such as mail.hobbiton.co.nz aligning with hobbiton.co.nz. - Strict alignment requires an exact domain match. The DMARC tags adkim and aspf control DKIM alignment and SPF alignment. Most Mailgun senders begin with relaxed alignment because it supports practical subdomain sending while still enforcing DMARC compliance. ## Configuring SPF and DKIM Records in Mailgun Correctly SPF and DKIM are the foundation of Mailgun email authentication. DMARC relies on SPF and DKIM results, so do not **publish a DMARC policy** before confirming that Mailgun’s SPF and DKIM records are valid in DNS. ### Configure SPF: Sender Policy Framework for Mailgun SPF, short for Sender Policy Framework, identifies which mail servers are authorized to send on behalf of your domain. In Mailgun, SPF is typically added as a DNS TXT record that includes Mailgun’s sending infrastructure. A common SPF TXT record looks similar to: ``` v=spf1 include:mailgun.org ~all ``` _Your exact SPF value may vary depending on Mailgun’s instructions, so use the value shown in the Mailgun Control Panel_. If your domain already has **SPF for Google Workspace**, Microsoft 365, or another sender, do not create a second SPF record. DNS should contain only one SPF TXT record per hostname. Instead, merge the mechanisms into one record. For example: ``` v=spf1 include:_spf.google.com include:mailgun.org ~all ``` This allows both Google and Mailgun SMTP servers to pass SPF. However, SPF alone is not enough for DMARC because SPF alignment can fail when return-path or bounce domains differ from the visible From address. That is why DKIM is usually the stronger authentication path for Mailgun DMARC alignment. ![SPF Merging Rule](https://media.mailhop.org/autospf/spf-tool-6328-1782203606764.jpg) ### Configure DKIM: DomainKeys Identified Mail for Mailgun DKIM, or DomainKeys Identified Mail, signs outbound email with a private key. Receiving mail servers retrieve the [public key](https://www.coursera.org/in/articles/public-key) from DNS and validate the DKIM signature. If DKIM passes and the DKIM signing domain aligns with the **From address domain**, DMARC can pass even if SPF alignment does not. Mailgun will provide one or more DKIM DNS records. These are usually CNAME or TXT records, depending on your Mailgun configuration. Publish them exactly as shown by Mailgun. Once [DNS propagation](https://www.networksolutions.com/blog/what-is-dns-propagation/) completes, Mailgun should mark DKIM as verified. #### Common SPF and DKIM Mistakes Common mistakes include publishing DKIM under the wrong hostname, adding quotation marks incorrectly, **creating duplicate SPF records**, or authenticating a root domain while sending from a different subdomain. For instance, if John Doe sends from [newsletter@marketing.johndoe.com](mailto:newsletter@marketing.johndoe.com), DKIM should support that sending domain, not only johndoe.com. ##### When to Contact Mailgun Support If SPF or DKIM does not verify after DNS propagation, check the record with [AutoSPF](https://autospf.com/), _MX Toolbox, Dmarcian, or Red Sift Investigate_. If the record appears correct but Mailgun still does not validate it, contact the Mailgun Support team with screenshots from your DNS provider and the Mailgun app. ## Creating and Publishing a DMARC Record for Mailgun Once SPF and DKIM are in place, **create your DMARC record**. A DMARC record is published in DNS as a TXT record at `_dmarc.yourdomain.com`. For example, if your sending domain is testdomain.com, the hostname is: ``` _dmarc.testdomain.com ``` A starter DMARC record usually looks like this: ``` v=DMARC1; p=none; rua=mailto:dmarc-reports@testdomain.com ``` This DMARC syntax includes the DMARC version, the DMARC policy, and a destination for aggregate DMARC reporting. The rua tag defines the **report email address** that receives aggregate reports from participating receivers. ![DMARC Rollout Phases](https://media.mailhop.org/autospf/spf-test-5992-1782203705934.jpg) ### Choose the Right DMARC Policy Your DMARC policy determines the policy action receivers should take when a message fails DMARC authentication checks and alignment. The main DMARC policy options are: - **none policy**: p=none monitors traffic without asking receivers to block or filter messages. - **quarantine**: p=quarantine asks receivers to **place failing messages** in spam or suspicious folders. - **reject**: p=reject asks receivers to reject failing messages outright. Most Mailgun senders should begin with p=none. This lets you collect DMARC reporting data while you verify that SPF, DKIM, and alignment are working correctly. After reviewing reports and fixing unauthorized sources, you can move from p=none to p=quarantine, then eventually to p=reject. A more complete DMARC record might look like: ``` v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@testdomain.com; adkim=r; aspf=r ``` Here, adkim=r and aspf=r set relaxed alignment for DKIM and SPF. If you later require stricter controls, you **might use strict alignment** with adkim=s and aspf=s, but only after confirming all legitimate Mailgun traffic passes DMARC. _Tools such as the Dmarcian Record Wizard, Red Sift, and MX Toolbox can help generate or validate a DMARC record_. Red Sift BIMI Checker may also be useful if you plan to implement BIMI after reaching a stronger DMARC policy, usually p=quarantine or p=reject. ## Testing, Monitoring, and Troubleshooting Mailgun DMARC Alignment After publishing DNS records, **wait for DNS propagation** and then test thoroughly. In Mailgun, verify that the domain shows SPF and DKIM as active. Then send test messages from your Mailgun sending domain to Gmail, Yahoo Mail, and other inboxes. Inspect message headers to confirm SPF pass, DKIM pass, and DMARC pass. ### Check DMARC Configuration and Reports Use DMARC tools to check DMARC configuration before increasing enforcement. Dmarcian, Red Sift Investigate, MX Toolbox, and Google Postmaster Tools can help confirm that your DMARC record is valid and that [email authentication](https://autospf.com/blog/best-email-authentication-tools-enterprise-2026-complete-guide-solutions/) is working as expected. ![Mailgun DMARC Setup: A Guide to Email Authentication Alignment](https://media.mailhop.org/autospf/spf-all-5728-1782203788722.jpg) For ongoing monitoring, review aggregate DMARC reporting. These reports show which sources are sending mail for your domain, whether SPF and DKIM pass, and whether alignment succeeds. This is especially important if **you use multiple platforms**, such as Mailgun for transactional email, Google Workspace for employee email, and another service for newsletters. Google Postmaster Tools is also valuable for monitoring spam rate, domain reputation, authentication status, and delivery trends. If Gmail [inbox placement](https://www.mailmunch.com/blog/inbox-placement) drops after a DMARC policy change, review authentication checks, complaint rates, and unsubscribe compliance. ### Troubleshoot Alignment Failures If DMARC fails while SPF passes, the SPF domain may not align with the From address. This can happen when the envelope sender or return-path domain differs from the visible From domain. If DMARC fails while DKIM passes, the **DKIM signing domain** may be different from the From address domain. In Mailgun, make sure the correct sending domain is authenticated and used in your messages. For example, sending as [alerts@johndoe.com](mailto:alerts@johndoe.com) through a Mailgun domain configured as mg.superelitebusiness.com may pass DKIM for the Mailgun domain but fail DMARC alignment for johndoe.com. _To fix this, authenticate the correct Mailgun sending domain or adjust the From address to match the authenticated domain strategy_. Also, confirm that only one DMARC record exists for a domain. Multiple DMARC TXT records at the same hostname can cause receivers to treat the **DMARC configuration as invalid**. If you are testing with testdomain.com, publish only one `_dmarc.testdomain.com` record. Move slowly from monitoring to enforcement. Start with p=none, validate legitimate senders, then apply p=quarantine to reduce spoofing risk. When reports show consistent DMARC compliance, consider p=reject for the strongest email security posture. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 3m 5 key contributors to the development of the Sender Policy Framework Nov 12, 2024 ](/blog/5-key-contributors-to-sender-policy-framework-development/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Mailgun DMARC Setup Guide: Configuring SPF, DKIM, And DMARC Correctly","description":"Learn how to configure Mailgun SPF, DKIM, and DMARC correctly to improve email authentication, deliverability, and domain security.","url":"https://autospf.com/blog/mailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly/","datePublished":"2026-06-23T00:00:00.000Z","dateModified":"2026-06-23T00:00:00.000Z","dateCreated":"2026-06-23T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/mailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/dmarc-generator-5863-1782203485932.jpg","caption":"Mailgun DMARC Setup"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Mailgun DMARC Setup Guide: Configuring SPF, DKIM, And DMARC Correctly","item":"https://autospf.com/blog/mailgun-dmarc-setup-guide-configuring-spf-dkim-and-dmarc-correctly/"}]} ```