Guide · Mailgun

Add and verify a sending domain in Mailgun

Create the domain as a subdomain like mg.example.com, paste the five records Mailgun generates, and verify — your root domain's mail setup stays untouched.

Published July 11, 2026 · ~3 min read

The process

The whole path from a fresh Mailgun account to a verified sending domain. The subdomain choice in step one is the decision that makes everything else painless.

Directions

1Use a subdomain, not your root domain

Before clicking anything, decide the domain name. Mailgun's own recommendation — and the setup that avoids every conflict — is a dedicated subdomain such as mg.example.com. Your root domain almost certainly already has an SPF record and MX records for your real mailbox provider; adding Mailgun's on top of those means merging SPF strings and fighting MX priorities.

A subdomain gets its own clean SPF, its own DKIM, and its own MX records that can't collide with anything. Recipients still see mail from [email protected] if you set the From address that way — the subdomain is the envelope and signing infrastructure, not the visible address.

2Add the domain in the Mailgun dashboard

Log in at app.mailgun.com, go to Send → Sending → Domains, and click Add new domain. Enter mg.example.com, pick your region (US or EU — this is permanent and determines the API endpoint, so EU-based data residency needs the EU region), and create it with a 2048-bit DKIM key, which is the default.

3Copy the generated records

Mailgun shows the exact records for your domain: two TXT records (SPF and DKIM), two MX records for receiving bounces and replies at the subdomain, and a CNAME for open/click tracking. Copy them from your dashboard rather than from anyone's example — the DKIM selector and host values are specific to your domain.

mg.example.com            TXT    v=spf1 include:mailgun.org ~all
smtp._domainkey.mg....    TXT    k=rsa; p=MIIBIjANBg... (your key)
mg.example.com            MX 10  mxa.mailgun.org
mg.example.com            MX 10  mxb.mailgun.org
email.mg.example.com      CNAME  mailgun.org

4Paste them into your DNS host

Add each record at your DNS provider. Watch the host fields: most panels append your domain automatically, so the SPF TXT goes at host mg (not mg.example.com.example.com), and the DKIM at smtp._domainkey.mg. On Cloudflare, set the tracking CNAME to DNS only (grey cloud) — proxied tracking links break open and click recording.

The MX records on the subdomain are safe to add even though you have MX on the root; they only govern mail sent to @mg.example.com addresses, which is exactly the bounce traffic Mailgun needs to see.

5Verify, then send a test

Back in Mailgun click Verify DNS settings. Records typically confirm within minutes; the dashboard shows a green check per record so you can see exactly which one is still pending. Once the domain state is Active, send a test message through the API or SMTP credentials and check the headers at the receiving end — you want spf=pass and dkim=pass with header.d=mg.example.com.

Finally, if you'll send at any volume, publish a DMARC record on the root domain if you haven't already — Mailgun's SPF and DKIM alignment on the subdomain will pass a relaxed-alignment DMARC policy out of the box.

Common issues & fixes

SPF or DKIM shows unverified for hours.

Almost always a doubled host name (mg.example.com.example.com) from pasting the full hostname into a panel that appends the zone. Fix the host field and re-verify.

You used the root domain and mail broke.

The new SPF TXT conflicted with your existing one — two v=spf1 records void SPF entirely. Delete Mailgun's, merge include:mailgun.org into your single existing record, or better, recreate the domain as a subdomain.

Opens and clicks aren't tracking.

The email.mg CNAME is missing, or it's proxied through Cloudflare. Set it to DNS only. Tracking also requires enabling open/click tracking per domain in Mailgun settings.

Mail lands in spam despite passing checks.

A brand-new domain and subdomain have no reputation. Warm up gradually — Mailgun's sending queue respects rate limits you set — and make sure the visible From domain publishes DMARC.

API returns 401 after setup.

You're using the wrong region's endpoint. EU-created domains must call api.eu.mailgun.net; the US endpoint returns unauthorized even with a valid key.

Honesty note: articles are drafted with AI assistance, then a human checks each one against the vendor's current setup flow before it publishes — nothing goes live unreviewed. Vendor interfaces still change; if a step looks different, the underlying record is what matters.