SPF record for Mailgun

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

On a Mailgun sending subdomain (for example mg.example.com)

Type: TXT · Host: mg · 5 of 10 DNS lookups Copy

v=spf1 include:mailgun.org ~all

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

If you verify your main domain in Mailgun and use Google Workspace

Type: TXT · Host: @ · 6 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:mailgun.org ~all

How SPF applies to Mailgun mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Mailgun sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Mailgun says verified domains aren't subject to a sending limit of 300 emails a day and lose the "sent via Mailgun.org" notice.
• At 5 lookups, include:mailgun.org on your main domain next to Microsoft 365 or Google Workspace leaves room for few other senders. A subdomain gets its own 10-lookup budget.

How to add it

1. Add your sending domain in Mailgun. A subdomain like mg.example.com keeps Mailgun traffic separate from your main domain's reputation.
2. Copy the DNS records from the Domain Verification & DNS section of the Mailgun control panel.
3. Publish the SPF TXT record, the DKIM TXT record, the tracking CNAME and the two MX records (mxa.mailgun.org and mxb.mailgun.org, priority 10) on that domain.
4. Verify the domain in Mailgun, then check it with the SPF Checker below.

DKIM and DMARC alignment

Mailgun's DKIM record is a TXT record you copy from the control panel. A subdomain such as mg.example.com still aligns with mail sent from example.com under DMARC's default relaxed alignment, for both SPF and DKIM (RFC 9989 section 4.4).

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Mailgun's include costs 5 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Mailgun's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:mailgun.org to your main domain when you only verified mg.example.com in Mailgun. SPF is checked on the domain Mailgun sends from, so the main-domain include costs 5 lookups for nothing.