Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Mailgun

Mailgun signs for the domain you add, usually a subdomain such as mg.example.com. By default you publish a TXT key under a selector Mailgun assigns, such as pic._domainkey.mg. With Automatic Sender Security you instead publish two CNAMEs, pdk1._domainkey and pdk2._domainkey, and Mailgun rotates 2048-bit keys for you, every 120 days by default.

Record type
TXT or CNAME
Selectors
assigned by Mailgun (e.g. pic, krs, smtp), pdk1, pdk2 (Automatic Sender Security)
Private key held by
Provider (TXT key or CNAMEs)

The DNS records

Use the exact selector and value shown on your domain's DNS records tab: Mailgun says the selector is unique per sending domain.

Manual key for the sending domain mg.example.com

Type: TXT · Host: pic._domainkey.mg 

k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…

Mailgun's examples also use krs, smtp and mailo as selectors. A 2048-bit key may need splitting into 255-character strings.

Automatic Sender Security, selector 1

Type: CNAME · Host: pdk1._domainkey.mg 

pdk1._domainkey.9d876.dkim1.mailgun.com

9d876 is Mailgun's example; your account has its own value.

Automatic Sender Security, selector 2

Type: CNAME · Host: pdk2._domainkey.mg 

pdk2._domainkey.9d876.dkim1.mailgun.com

Set it up and turn on signing

  1. In Mailgun, go to Send > Sending > Domains and click Add new domain. Mailgun recommends a subdomain such as mg.example.com or mail.example.com.
  2. To have Mailgun manage keys, turn on Automatic Sender Security under Advanced settings. For an existing domain, use the Actions menu and Turn on automatic sender security in the Sending records section.
  3. For a manual key, open the domain's DNS records tab, click Create new DKIM, choose 1024 or 2048 bits, and click Create.
  4. Publish the records, click Check status, and activate a manual key from the gear icon with Activate.
  5. When moving to Automatic Sender Security, Mailgun keeps signing with the TXT key until the CNAMEs verify, then deactivates the manual keys.

DMARC alignment

Mailgun signs with the domain you added. A subdomain such as mg.example.com aligns under DMARC's relaxed mode with a From address at example.com, but not under strict mode (adkim=s), where the From domain must match exactly. An unverified domain shows as "sent via Mailgun.org" and is limited to 300 messages a day.

Key length and rotation

Manual keys are 1024 or 2048 bits, up to three per domain, and Mailgun recommends rotating at least every six months. Automatic Sender Security uses two 2048-bit selectors and rotates every 120 days by default; you can shorten or lengthen the period, with five days as the minimum. After a manual rotation, Mailgun suggests sending several test messages before deleting the old key. Not every listed key needs to show Verified, only the one that signs.

Common mistakes

  • Guessing the selector. Mailgun assigns it per domain; copying pic from a guide when your domain uses krs publishes a key nobody looks up.
  • Publishing at the root. For mg.example.com the name is <selector>._domainkey.mg in the example.com zone, not <selector>._domainkey.
  • Deleting the TXT key early. Keep it until the CNAMEs verify; Mailgun signs with it until then.
  • Strict DKIM alignment with a subdomain. adkim=s in your DMARC record fails mail signed for mg.example.com.

Check your Mailgun DKIM key

Enter your domain and the selector from your Mailgun account. Free, reads public DNS only.

Frequently asked questions

What is Mailgun Automatic Sender Security?

A setup where you publish two CNAMEs, pdk1._domainkey and pdk2._domainkey, and Mailgun hosts 2048-bit keys behind them. It rotates them every 120 days by default, adjustable down to five days, with no DNS changes from you.

Why does Mailgun recommend a subdomain like mg.example.com?

Mailgun recommends a subdomain for deliverability: it keeps bulk or app mail separate from people's mail at the root. Its DKIM signature uses that subdomain, which still aligns with a From address at your root domain under relaxed DMARC.

How many DKIM keys can a Mailgun domain have?

Up to three manual keys per domain, which lets you publish a new one before retiring the old. With several active, Mailgun's docs describe choosing a signing key per message, so keep all published keys valid.

Sources

Checked against Mailgun's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Mailgun

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated