Fix guide

How to Fix DMARC Alignment for Mailgun

Mailgun uses @mailgun.org until you add a verified domain with DKIM + bounce CNAMEs — then you’re aligned with your brand.

Why Mailgun trips DMARC

Unverified domain = bounce path @mailgun.org while From: says your startup — DMARC wants SPF or DKIM to match your brand.

Exact DNS records (pattern)

Mailgun shows exact values per domain. Typical patterns:

email.yourdomain.com → CNAME → mailgun.org k1._domainkey.yourdomain.com → TXT → "k=rsa; p=[mailgun-public-key]" OR k1._domainkey.yourdomain.com → CNAME → k1.domainkey.yourdomain.com.mailgun.org

Step-by-step fix

Step 1 Mailgun → Sending → Domains → Add new domain

Step 2 Enter your domain name (use yourdomain.com not mg.yourdomain.com for best alignment)

Step 3 Copy all DNS records Mailgun provides — TXT for SPF, CNAME/TXT for DKIM, CNAME for tracking

Step 4 Add all records to your DNS provider

Step 5 Click Verify DNS settings in Mailgun — wait up to 48 hours

Step 6 Run DNS Preflight to confirm DKIM and SPF alignment

Run your domain through DNS Preflight

Open DNS Preflight →

Related glossary: DMARC · DMARC alignment · DKIM · SPF record

FAQ

Should I use yourdomain.com or mg.yourdomain.com as my Mailgun domain?

Use your root domain (yourdomain.com) for best DMARC alignment. Using a subdomain like mg.yourdomain.com can cause alignment failures with strict DMARC policies.

Why does Mailgun fail DMARC even after adding DNS records?

Check that you added the domain-specific DKIM record, not just SPF. Also verify the Return-Path CNAME is added — this enables SPF alignment.

How many DNS records does Mailgun require?

Typically 3: one TXT for SPF (include:mailgun.org), one TXT or CNAME for DKIM, and one CNAME for the Return-Path (tracking subdomain).

What is the Mailgun DKIM selector?

Mailgun uses k1 as the default DKIM selector. Your DKIM record goes at k1._domainkey.yourdomain.com.

How long does Mailgun domain verification take?

DNS propagation takes up to 48 hours. Mailgun's dashboard shows a green checkmark when all records are verified.

← All DMARC fix guides

Open DNS Preflight and re-check your zone →