Mailgun SPF, DKIM and DMARC check
Enter the domain you send from with Mailgun. We check the SPF include, the Mailgun DKIM key, your DMARC policy and MX records, and tell you what is missing.
What Mailgun expects
SPF
Add include:mailgun.org to your single SPF record, for example: v=spf1 include:mailgun.org ~all
Mailgun is usually set up on a sending subdomain such as mg.yourdomain.com. Put the SPF record on that subdomain, not on your root. include:mailgun.org costs 5 SPF lookups (checked October 2026), so it would crowd a root record.
Build a combined SPF record if you send from more than one service.
DKIM
Selectors we look for: smtpmxk1pickrsmailo
Mailgun shows a DKIM TXT record with its own selector (often something like "smtp", "pic" or "krs") under Sending > Domains > DNS records. Enter that selector above, and check the subdomain you set up rather than your root.
DMARC
DMARC is set on your domain, not in Mailgun. If you have none, start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com and tighten it once reports look clean. Generate one.
MX
mxa.mailgun.org and mxb.mailgun.org, only on the Mailgun subdomain and only if you receive mail through Mailgun.
Values come from Mailgun’s public setup documentation and can change. The Mailgun control panel always shows the exact records for your account. Use those if they differ from this page.
Keep it working after setup
The usual failures come later: a second SPF record added for a new tool, a DKIM CNAME lost in a DNS move, a DMARC record deleted with an old zone. SenderBeacon checks twice a day and emails you in plain English. From $9/month, 14-day free trial, no card.
Start free trialQuestions
How long until Mailgun DNS changes show up?
Usually minutes, sometimes up to an hour, depending on the TTL on your records and your DNS host. Re-run the check after publishing.
Why does the check say DKIM is missing when Mailgun says it is verified?
Most often the record went on the wrong host (for example _domainkey.yourdomain.com.yourdomain.com, because the DNS host appended the domain twice), or you are checking a different domain or subdomain than the one you send from.