# SPF record for Mailgun

URL: https://iblockspam.com/spf/mailgun
Last updated: 2026-10-09

Include: include:mailgun.org
Where it goes: The sending domain you verify (a subdomain is recommended)
DNS lookups: 5 of 10

Mailgun asks for the TXT record v=spf1 include:mailgun.org ~all on the domain you verify in Mailgun. Mailgun recommends sending from a subdomain such as mg.example.com, so the record usually goes there, not on your main domain. We measured include:mailgun.org at 5 DNS lookups, because it nests Mailgun's US and EU records.

## Example records

- On a Mailgun sending subdomain (for example mg.example.com) (TXT, host mg): `v=spf1 include:mailgun.org ~all`
- Your main domain on Microsoft 365 stays as it is (TXT, host @): `v=spf1 include:spf.protection.outlook.com -all`
- If you verify your main domain in Mailgun and use Google Workspace (TXT, host @): `v=spf1 include:_spf.google.com include:mailgun.org ~all`

## Notes

- Mailgun says verified domains aren't subject to a sending limit of 300 emails a day and lose the "sent via Mailgun.org" notice.
- At 5 lookups, `include:mailgun.org` on your main domain next to Microsoft 365 or Google Workspace leaves room for few other senders. A subdomain gets its own 10-lookup budget.

## How to add it

- Add your sending domain in Mailgun. A subdomain like `mg.example.com` keeps Mailgun traffic separate from your main domain's reputation.
- Copy the DNS records from the Domain Verification & DNS section of the Mailgun control panel.
- Publish the SPF TXT record, the DKIM TXT record, the tracking CNAME and the two MX records (`mxa.mailgun.org` and `mxb.mailgun.org`, priority 10) on that domain.
- Verify the domain in Mailgun, then check it with the SPF Checker below.

## DKIM and DMARC

Mailgun's DKIM record is a TXT record you copy from the control panel. A subdomain such as `mg.example.com` still aligns with mail sent from `example.com` under DMARC's default relaxed alignment, for both SPF and DKIM ([RFC 9989 section 4.4](https://www.rfc-editor.org/rfc/rfc9989.html#section-4.4)).

## Common mistakes

- Adding `include:mailgun.org` to your main domain when you only verified `mg.example.com` in Mailgun. SPF is checked on the domain Mailgun sends from, so the main-domain include costs 5 lookups for nothing.

**Q: What is the SPF record for Mailgun?**
`v=spf1 include:mailgun.org ~all`, published as a TXT record on the domain you verify in Mailgun. If that domain already has an SPF record, add the include to it instead of creating a second one.

**Q: Should I put Mailgun's SPF on my main domain or a subdomain?**
Mailgun recommends that customers send from a subdomain, such as `mg.example.com`. The SPF record then goes on that subdomain, your main domain's record stays unchanged, and the subdomain has its own 10-lookup budget.

**Q: Why does include:mailgun.org use so many lookups?**
It nests Mailgun's US and EU records, which nest further records. We measured 5 lookups on 9 October 2026. Check your total with the [SPF Checker](https://iblockspam.com/tools/spf-checker) before adding it next to other providers.

Sources:
- Mailgun Documentation: Domain verification: https://documentation.mailgun.com/docs/mailgun/user-manual/domains/domains-verify
- Mailgun blog: The basics of email subdomains: https://www.mailgun.com/blog/deliverability/the-basics-of-email-subdomains/
- RFC 9989 section 4.4: Identifier alignment explained: https://www.rfc-editor.org/rfc/rfc9989.html#section-4.4

---

Source: iBlockSpam, https://iblockspam.com/spf/mailgun (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt