Checking DMARC Compliance When Using Mailgun

Mailgun is a popular transactional email service for developers, and the default setup usually works well — until you enable DMARC enforcement. At that point, a lot of teams discover that their Mailgun traffic has been passing SPF and DKIM in isolation but not actually aligning with the From: header domain. This guide covers exactly what to configure in Mailgun so DMARC passes.

Why alignment matters with Mailgun

Mailgun gives you a default sending domain like mg.yourdomain.com or sandbox123.mailgun.org. If you send from [email protected] but Mailgun signs the message with a key for mg.yourdomain.com, DMARC in strict mode will fail because the DKIM domain doesn't match the From: domain.

DMARC has two alignment modes:

In relaxed mode, a DKIM signature from mg.yourdomain.com aligns with a From: address at yourdomain.com because they share the same organisational domain. In strict mode it fails.

Step 1: Add and verify your sending domain

In the Mailgun dashboard, go to Sending → Domains → Add New Domain. Enter the domain you want to send from. Mailgun strongly recommends a subdomain like mg.yourdomain.com rather than the root domain — this keeps Mailgun's sending reputation separate from your main mail.

Mailgun will provide DNS records to publish. These include:

• TXT record for SPF (v=spf1 include:mailgun.org ~all)
• TXT record for DKIM (long public key)
• Optional MX records for inbound routing
• Optional CNAME for open/click tracking

Publish these and click Verify DNS Settings in Mailgun.

Step 2: Confirm DKIM is signing correctly

Send a test email from your Mailgun domain and inspect the raw headers. You should see an Authentication-Results header showing:

dkim=pass header.d=mg.yourdomain.com
spf=pass smtp.mailfrom=mg.yourdomain.com

If DKIM shows neutral or none, the DNS record hasn't propagated or the selector is wrong. Wait 30 minutes and try again.

Step 3: Check DMARC alignment

With mg.yourdomain.com as the signing domain and yourdomain.com as your From:, relaxed alignment works automatically. Verify your DMARC record is published correctly using the free DMARC record checker.

A reasonable starter record:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r

adkim=r and aspf=r mean relaxed alignment — which is what you want with Mailgun's subdomain setup.

Step 4: Handle the From: header carefully

A surprisingly common bug is setting the From: address in your application to the wrong domain. If your Mailgun domain is mg.yourdomain.com but your code sends From: [email protected], DMARC will fail because someotherbrand.com has no authenticated sender.

Always send From: addresses on the same organisational domain you configured in Mailgun.

Step 5: Watch DMARC reports

Once configured, aggregate reports will tell you whether Mailgun traffic is aligning. Look for entries where header_from is your domain and the authentication result is dkim=pass. If you see dkim=fail for Mailgun IPs, recheck your DNS records and DKIM selector.

Common Mailgun + DMARC mistakes

EU vs US regions

Mailgun operates separate EU and US infrastructure. If you created a domain in one region and sign up again in the other, you'll end up with two sets of DNS records. Only the ones matching your actual region will work — delete the unused ones to avoid confusion.

Building and monitoring your DMARC record

If you're adding Mailgun to an existing email stack, your SPF and DMARC records may need updating. dmarccreator.com will generate a valid record, and deliverabilitychecker.com watches for changes and alignment failures over time.