Mailgun domain not verified: fix the SPF, DKIM, MX and CNAME records

What it means

When you add a sending domain in Mailgun, it gives you DNS records to publish. Until Mailgun finds them, the domain is unverified and you cannot send normally from it. Sending attempts are refused; the message usually says the domain is not allowed to send because it is unverified and requires DNS configuration.

Mailgun's documentation says the two TXT records, SPF and DKIM, are what verify the domain for sending. The MX records (to receive replies or use Routes) and the tracking CNAME (for opens, clicks and unsubscribes) are recommended but serve other features.

Why it happens

• Records at the wrong name. Mailgun usually suggests a subdomain such as mg.yourdomain.com. Records must then be at mg.yourdomain.com and selector._domainkey.mg.yourdomain.com, not on the root domain. Some panels also add the domain twice (for example mg.yourdomain.com.yourdomain.com).
• Two SPF records on the same name: the old one and the Mailgun one. SPF then fails with a permerror. Merge them into one (see several SPF records on one domain).
• DKIM key broken: truncated when pasted, quotes added inside the value, or a long key split incorrectly.
• Proxy or CNAME flattening: on Cloudflare, proxied records break mail records (see Cloudflare proxied records break email).
• A CNAME on the same name as the SPF TXT record: a CNAME hides every other record at that name.
• Wrong DNS zone: records added at the registrar while the domain uses other name servers.
• Region values mixed: EU domains use EU hosts for MX and tracking (mxa.eu.mailgun.org, eu.mailgun.org).

How to check

In the Mailgun control panel, open Send, Domains, your domain, then the DNS records section. Each record shows a status. Copy the exact values from there: they are specific to your domain and region. They usually look like this for a US domain:

mg.yourdomain.com.                     TXT    "v=spf1 include:mailgun.org ~all"
selector._domainkey.mg.yourdomain.com. TXT    "k=rsa; p=MIGfMA0GCSqGSIb3DQEB..."
mg.yourdomain.com.                     MX 10  mxa.mailgun.org.
mg.yourdomain.com.                     MX 10  mxb.mailgun.org.
email.mg.yourdomain.com.               CNAME  mailgun.org.

The DKIM selector name (the part before ._domainkey) is chosen by Mailgun. Newer domains with Automatic Sender Security may show DKIM as CNAME records instead of a TXT key, so Mailgun can rotate the keys itself; publish them exactly as shown. Then query DNS yourself:

dig +short TXT mg.yourdomain.com
dig +short TXT selector._domainkey.mg.yourdomain.com
dig +short NS yourdomain.com

The Delivmail domain scanner also reads the SPF, DMARC, MX and DKIM records of your sending domain as the outside world sees them.

How to fix it

1. Use a dedicated subdomain like mg.yourdomain.com if your root domain already receives mail elsewhere. Do not point your root domain's MX records to Mailgun unless Mailgun should receive all its mail.
2. Publish one SPF record per name. On a dedicated subdomain, v=spf1 include:mailgun.org ~all is enough. If you send from the root domain with other services too, add include:mailgun.org to the existing record instead of creating a second one.
3. Paste the DKIM value in one piece, without extra quotes. If your provider limits TXT strings to 255 characters, let it split the value into several strings in the same record.
4. Turn off proxying and remove any conflicting CNAME on the same names.
5. Click "Verify DNS settings" in the domain settings, or wait for Mailgun's automatic checks. New records usually appear within minutes, but caches can delay it; a cached "no record" answer can last until its TTL expires.
6. Add DMARC on your root domain if you have none, for example _dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com". Mailgun's DKIM on mg.yourdomain.com aligns with a From address on mg.yourdomain.com, and also with yourdomain.com in relaxed mode.

Until the domain is verified, you can test with the sandbox domain, which only delivers to authorized recipients: see Mailgun sandbox: authorized recipients only.

Check that it is fixed

All records should show as verified in the Mailgun panel. Send a message through Mailgun from your verified domain to the unique address on the Delivmail home page: the report should show SPF passing for mg.yourdomain.com (Mailgun uses it as the bounce domain), DKIM passing with d=mg.yourdomain.com (or your domain), and DMARC passing. Then resend the messages that failed.