Why do I need to verify my domain?

Mailgun requires domain verification for two primary reasons. First, it confirms that you are the owner of the domain, preventing unauthorized senders from using your domain in our platform. Second, the SPF and DKIM records authorize our SMTP servers to send on behalf of your domain. This serves to significantly improve your deliverability - our specialty!

DNS records can be a bit tricky, but if you know a few tips, you can greatly enhance your success with the process. Let’s take a look at some common issues seen when attempting to verify your domain.

Do you have any DNS guides or tutorials?

Yes, we do have in-depth, step-by-step guides for the following DNS providers below:

• GoDaddy
• Cloudflare
• Namecheap
• Google Domains
• DigitalOcean

Aside from the guides listed above, this article outlines a general three-step DNS setup process.

I created my records, but Mailgun does not see them

You always want to double-check any changes you make to your DNS configuration via both a local and a public query. Local queries can be performed using built-in utilities like dig (Linux/Unix) and nslookup (Windows).

To verify via a dig command, the syntax is: dig -t <record type> <hostname>

dig -t TXT domain.tld 

; <<>> DiG 9.8.3-P1 <<>> -t TXT domain.tld
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64695

;; QUESTION SECTION:
;domain.tld. IN TXT

;; ANSWER SECTION:
domain.tld. 600 IN TXT "v=spf1 include:mailgun.org ~all"

To verify via nslookup, the syntax is: nslookup -q=<record type> <hostname>

nslookup -q=TXT domain.tld

Server: 1.1.1.1
Address:       1.1.1.1#53

Non-authoritative answer:
domain.tld text = "v=spf1 include:mailgun.org ~all"

In some cases, there might be a local DNS server within your network that will take precedence over public queries. Even if you don’t have a local DNS server, we recommend performing a secondary public query for your domain. One great tool is What’s My DNS - https://www.whatsmydns.net/. What’s My DNS will query multiple servers around the globe to best gauge the propagation of your changes. 

To use, just enter your hostname and select the record type from the options present in the dropdown.

• If the correct value is returned - congratulations! The record was successfully created.
• If you do not see the correct value (or see all red X’s) - something's not quite right yet. Make sure to double-check your configuration and correct your DNS setup as needed.

Note: Some DNS provider's panels will automatically append the root domain name following whatever's placed in the hostname value; for instance, if your domain is mail.example.com, you might only need "mail" in the hostname field, or you could be creating a record for mail.example.com.example.com by accident. To help ensure productive use of your time, reach out to your DNS provider to find out how their panel operates.

The DKIM record is verified, but the SPF is not verified

It takes two TXT records to verify your domain; SPF and DKIM. If everything looks good with your DKIM record, but not with your SPF, here are a few elements to check:

• There can only be 1 SPF record per hostname. If your hostname has more than 1 SPF record, the records will need to be merged into a single value.

dig -t TXT domain.tld 
"v=spf1 include:mailgun.org ~all"
"v=spf1 ip4:1.2.3.4 include:smtp.domain.tld ~all"

In this case, the issue is occurring due to the separation of the values into two separate entries. The fix is simple - just combine them. You can place the Mailgun include directive (include:mailgun.org) anywhere after v=spf1 and before ~all. The new value would be:

v=spf1 ip4:1.2.3.4 include:smtp.domain.tld include:mailgun.org ~all

Note: Make sure that your SPF record doesn't exceed 10 lookups, or you'll run into issues.

• If the hostname has a CNAME in addition to any other record type (i.e. TXT, A, etc), the CNAME will take precedence.

dig domain.tld
domain.tld.   300 IN CNAME mailgun.org
domain.tld.   300 IN TXT "v=spf1 include:mailgun.org ~all"

To resolve this and verify the TXT, the CNAME would need to be removed from the hostname. Alternatively, another sending subdomain would need to be used with the Mailgun account, such as (for this example) mg.domain.tld.

The records are resolving, but Mailgun still says that the domain is “Unverified”

Depending on the DNS hosting provider, records can take up to 24-48 hours to fully propagate. A manual DNS verification can be attempted if 24 hours have already passed and the records are confirmed correct via both local and public queries.

To perform a manual verification and update the DNS records cache, we'll show you how to do this below:

1. First, log in to the Mailgun Control Panel (if you have not already done so).
2. Then, within the left-hand navigation pane, click the Sending option to expand its list of suboptions.
3. Next, click the Domain settings suboption, and on the resulting page, click the DNS records tab.
4. Ensure that the domain for which you wish to perform manual DNS verification is displayed within the Domain drop-down list towards the upper-right portion of the page.
   
5. Click the Verify DNS settings button.

What is the DKIM authority and under what circumstances can I modify it?

DKIM is an excellent resource for an email service provider (ESP) to track a domain's reputation because signing messages via DKIM is considered authoritative. As an ESP, we take care of a lot of the DKIM heavy lifting on your behalf; however, there are some customization options you should know about. 

At Mailgun, our standard recommendation is to have your sending domain be a subdomain off your main root domain. As such, our customers have the option of setting the DKIM authority to either be that subdomain or the root (with the caveat that both domains are set up within your Mailgun account.) 

Let's say your main root domain name is catzrule.org (because cats indeed rule), but you've set your Mailgun sending domain name as mg.catzrule.org. By default, our system will want to set the DKIM authority for both domains to catzrule.org. You can overrule that using our API and have mg.catzrule.org have its own value instead. This value can be changed at any time, but be aware that it can have ramifications for your domain reputation.

Other (optional, but strongly recommended) DNS records

While the two TXT records (SPF and DKIM) are all that's required to send messages via Mailgun, you do also have the option to add MX and CNAME records, if you choose. The process for adding these optional records is exactly the same as adding the required TXT records.

MX records are really only needed if you're looking to receive incoming mail for the exact domain or domains you have verified in your Mailgun account; keep in mind - you don't want to point your domain's MX records to Mailgun if you already have incoming mail setup elsewhere. If you do, adding Mailgun MX records will break this configuration, and you won't receive your mail as you have previously. 

Note: You only ever want to have one source specified for your MX records, otherwise servers get confused. Bad things happen when servers get confused.

A CNAME record is needed only if you're looking to enable our tracking features, keeping detailed records of Clicks, Opens, and/or Unsubscribes. 

Need Support?

Our Support Team here at Sinch Mailgun is happy to help! Reach out to us in the Support page of your Mailgun Control Panel, and we'll be with you shortly!