SPF, DKIM and DMARC for Mailgun

Short answer: Mailgun mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain, add include:mailgun.org to your one SPF record and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.

SPF	TXT at `@`	v=spf1 include:mailgun.org ~all Put it on the domain you send from in Mailgun. Mailgun suggests a subdomain such as `mg.yourdomain.com` when your main domain already runs your company mail; then this record goes at `mg`, not at `@`. Combine with your other senders →
DKIM	CNAME / TXT	TXT record at `<selector>._domainkey` of your sending domain, with the key from Mailgun's Domain Verification & DNS page. The selector differs per account (`krs`, `smtp`, `pic`, `k1`…).
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read, or a free report address that turns the reports into a dashboard; build your own.

Step by step

In the Mailgun control panel add your sending domain (e.g. mg.yourdomain.com) and pick the US or EU region.
Add the two TXT records it lists: SPF (v=spf1 include:mailgun.org ~all) and DKIM.
Want Mailgun to receive replies or route mail? Add MX mxa.mailgun.org and mxb.mailgun.org (priority 10) on the sending domain.
For open and click tracking add the CNAME (usually email) pointing to mailgun.org (eu.mailgun.org for EU domains).
Click Check DNS Records Now. Verification can take 24–48 hours.
Publish DMARC at _dmarc of your main domain with p=none; it covers subdomains too.

Mistakes that break it

Sending from your main domain? Add include:mailgun.org to the SPF record you already have instead of creating a second one.
The tracking CNAME must be the only record on its host name; if that name already has records, pick another subdomain.
EU-region domains use the eu.mailgun.org targets. Mixing up regions is a common reason verification fails.

Check that it worked

After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.

Other setup guides

Google Workspace · Microsoft 365 · Zoho Mail · Hostinger Email · Titan Email · GoDaddy email (Microsoft 365 and Professional Email) · Proton Mail · Cloudflare Email Routing · Mailchimp · SendGrid · Amazon SES · Shopify Email · Klaviyo · HubSpot · Brevo · Postmark · Zendesk · Constant Contact · MailerLite · Kit (ConvertKit)