# DKIM record for Mailgun

URL: https://iblockspam.com/dkim/mailgun
Last updated: 2026-10-09

Record type: TXT or CNAME
Selectors: assigned by Mailgun (e.g. pic, krs, smtp), pdk1, pdk2 (Automatic Sender Security)
Key managed by: Provider (TXT key or CNAMEs)

Mailgun signs for the domain you add, usually a subdomain such as `mg.example.com`. By default you publish a TXT key under a selector Mailgun assigns, such as `pic._domainkey.mg`. With Automatic Sender Security you instead publish two CNAMEs, `pdk1._domainkey` and `pdk2._domainkey`, and Mailgun rotates 2048-bit keys for you, every 120 days by default.

## DNS records

- Manual key for the sending domain mg.example.com (TXT, host pic._domainkey.mg): `k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ…` Mailgun's examples also use `krs`, `smtp` and `mailo` as selectors. A 2048-bit key may need splitting into 255-character strings.
- Automatic Sender Security, selector 1 (CNAME, host pdk1._domainkey.mg): `pdk1._domainkey.9d876.dkim1.mailgun.com` `9d876` is Mailgun's example; your account has its own value.
- Automatic Sender Security, selector 2 (CNAME, host pdk2._domainkey.mg): `pdk2._domainkey.9d876.dkim1.mailgun.com`

## Set it up and turn on signing

- In Mailgun, go to **Send > Sending > Domains** and click **Add new domain**. Mailgun recommends a subdomain such as `mg.example.com` or `mail.example.com`.
- To have Mailgun manage keys, turn on Automatic Sender Security under **Advanced settings**. For an existing domain, use the **Actions** menu and **Turn on automatic sender security** in the Sending records section.
- For a manual key, open the domain's **DNS records** tab, click **Create new DKIM**, choose 1024 or 2048 bits, and click **Create**.
- Publish the records, click **Check status**, and activate a manual key from the gear icon with **Activate**.
- When moving to Automatic Sender Security, Mailgun keeps signing with the TXT key until the CNAMEs verify, then deactivates the manual keys.

## DMARC alignment

Mailgun signs with the domain you added. A subdomain such as `mg.example.com` aligns under DMARC's relaxed mode with a From address at `example.com`, but not under strict mode (`adkim=s`), where the From domain must match exactly. An unverified domain shows as \"sent via Mailgun.org\" and is limited to 300 messages a day.

## Key length and rotation

Manual keys are 1024 or 2048 bits, up to three per domain, and Mailgun recommends rotating at least every six months. Automatic Sender Security uses two 2048-bit selectors and rotates every 120 days by default; you can shorten or lengthen the period, with five days as the minimum. After a manual rotation, Mailgun suggests sending several test messages before deleting the old key. Not every listed key needs to show Verified, only the one that signs.

## Common mistakes

- **Guessing the selector.** Mailgun assigns it per domain; copying `pic` from a guide when your domain uses `krs` publishes a key nobody looks up.
- **Publishing at the root.** For `mg.example.com` the name is `<selector>._domainkey.mg` in the `example.com` zone, not `<selector>._domainkey`.
- **Deleting the TXT key early.** Keep it until the CNAMEs verify; Mailgun signs with it until then.
- **Strict DKIM alignment with a subdomain.** `adkim=s` in your DMARC record fails mail signed for `mg.example.com`.

**Q: What is Mailgun Automatic Sender Security?**
A setup where you publish two CNAMEs, `pdk1._domainkey` and `pdk2._domainkey`, and Mailgun hosts 2048-bit keys behind them. It rotates them every 120 days by default, adjustable down to five days, with no DNS changes from you.

**Q: Why does Mailgun recommend a subdomain like mg.example.com?**
Mailgun recommends a subdomain for deliverability: it keeps bulk or app mail separate from people's mail at the root. Its DKIM signature uses that subdomain, which still aligns with a From address at your root domain under relaxed DMARC.

**Q: How many DKIM keys can a Mailgun domain have?**
Up to three manual keys per domain, which lets you publish a new one before retiring the old. With several active, Mailgun's docs describe choosing a signing key per message, so keep all published keys valid.

Sources:
- Mailgun Documentation: DKIM security: https://documentation.mailgun.com/docs/mailgun/user-manual/domains/dkim_security
- Mailgun Help Center: How can I rotate my DKIM key?: https://help.mailgun.com/hc/en-us/articles/16956951504539
- Mailgun Help Center: Cloudflare DNS setup guide: https://help.mailgun.com/hc/en-us/articles/15585722150299
- Mailgun Help Center: What domain name should I use with Mailgun?: https://help.mailgun.com/hc/en-us/articles/202256730
- Mailgun Documentation: Domain verification: https://documentation.mailgun.com/docs/mailgun/user-manual/domains/domains-verify

---

Source: iBlockSpam, https://iblockspam.com/dkim/mailgun (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt