Set up DMARC with Mailgun

Mailgun is set up, by convention, on a sending subdomain such as mail.yourdomain.com. Everything goes there — and that is the source of the most common error: putting the records at the root.

On the subdomain, not the root

mail.yourdomain.com                 TXT  v=spf1 include:mailgun.org ~all
mx._domainkey.mail.yourdomain.com   TXT  (DKIM public key)
mail.yourdomain.com                 MX   (the two records provided)

The two MX records handle bounces and inbound mail for the subdomain. If your plan uses Automatic Sender Security, the DKIM key is published as a CNAME rather than a TXT record, which lets Mailgun rotate it without you.

Why it aligns

The envelope address becomes mail.yourdomain.com, a subdomain of yours. Under relaxed alignment — DMARC’s default mode — a subdomain matches the parent domain: SPF aligns, and so does DKIM. There is nothing to add to your root domain’s SPF record.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Only tighten once every sender is identified. The progression, step by step.

Common mistakes with Mailgun

• Putting include:mailgun.org in the root SPF. Pointless if you send from the subdomain, and it consumes one of the ten permitted DNS lookups.
• Mistaking the tracking CNAME for authentication. email.mail.yourdomain.com serves opens and clicks; it plays no part in DMARC.
• Forgetting the subdomain’s MX records. Bounces stop coming back, and you lose visibility on dead addresses.
• Sending from the root when only the subdomain is configured: alignment is judged on the From: domain.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.