Understanding Mailgun (Sinch) Email Authentication
Mailgun provides robust transactional email APIs. Mailgun recommends sending from a dedicated subdomain (e.g. mg.yourdomain.com) with SPF and DKIM.
When Mailgun (Sinch) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Mailgun (Sinch)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Mailgun
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:mailgun.org ~all | 3600 | Mailgun SPF. |
Step-by-Step Setup Instructions
In Mailgun > Sending > Domains > Add New Domain.
Add the TXT SPF record: "v=spf1 include:mailgun.org ~all".
Add the DKIM TXT record at "k1._domainkey.yourdomain.com".
Add Mailgun MX records and click Verify.
Common Mailgun SPF Configuration Mistakes
× Mailgun Verification Yellow Warning
Cause: DNS propagation latency.
Fix: Wait 10 minutes and click Check DNS Records.
Frequently Asked Questions
What is the SPF include for Mailgun?
Use "include:mailgun.org".