[ Sending-service guides ]

Authenticate email sent through MailGun: configuration and verification

Authenticate a Mailgun sending domain with the correct DKIM mode, preserve receiving mail, and verify the actual application route rather than every historical key.

By the EmailAuth research team · 7 min read

[ Key points ]

  • Protect application continuity
  • Verify the active signing mode
  • Approve trust narrowly
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Authenticate a Mailgun sending domain with the correct DKIM mode, preserve receiving mail, and verify the actual application route rather than every historical key.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the active signing mode

Manual keys and Automatic Sender Security require different DNS records.

Next steps

  1. Capture the generated record set.
  2. Reverify after a mode change.
  3. Match the received selector to the active configuration.

CISO / SecOps

Approve trust narrowly

Verification must preserve other senders and incoming mail.

Next steps

  1. Review SPF lookup cost and ownership.
  2. Reject unrelated MX or policy changes.
  3. Require original received-message evidence.

Founder / Non-technical

Protect application continuity

Mailgun authentication can affect customer-facing transactional workflows.

Next steps

  1. Name the application and DNS owners.
  2. Agree the sending-domain scope.
  3. Keep a tested recovery route.

[ FAQs ]

Frequently asked questions

Which Mailgun DKIM record type should I publish?

Use the active domain configuration. Manual signing uses a supplied TXT key, while Automatic Sender Security uses supplied CNAME records.

Domain Verification Setup Guide – Mailgun Help Center Create a domain

Must every displayed DKIM key become verified?

No. Historical or secondary keys can remain unverified. Establish which configuration is active and confirm the received signature.

Domain Verification Setup Guide – Mailgun Help Center Getting started Sending Email

Should I change my company’s MX records to fix sending?

Not unless inbound mail is intentionally moving to Mailgun. Preserve the existing mailbox route when configuring outbound authentication.

DNS frequently asked questions – Mailgun Help Center

Can I add a second SPF record for Mailgun?

No. Maintain one applicable SPF policy at the owner and preserve its other authorized senders and lookup budget.

Domain Verification Setup Guide – Mailgun Help Center RFC 7208 SPF

Does a root DKIM authority change the envelope sender too?

Not automatically. The domain-creation reference distinguishes the DKIM authority from the SMTP mail-from host; check both in the actual route.

Create a domain

What happens after changing Automatic Sender Security?

The domain must be reverified. Coordinate its DNS records and signing transition before retiring the prior working configuration.

Update domain

Why can the application fail while the domain is Verified?

It may use a different route, signing identity or From address. Compare the actual received message with the configured domain.

Domain Verification Setup Guide – Mailgun Help Center Getting started Sending Email

What still blocks production acceptance?

A completed original identity table from the exact application route, live DNS evidence and human SME approval remain required.

[ Sources ]

Sources

  1. Domain Verification Setup Guide – Mailgun Help Center

    Sections Step 1: Add your domain to Mailgun · TXT records · Understanding DKIM Status · Step 3: Wait (up to 24-48 hours)

  2. Create a domain

    Sections Request: dkim_host_name · Request: force_dkim_authority · Request: force_root_dkim_host · Request: use_automatic_sender_security

  3. Update domain

    Sections Request: mailfrom_host · Request: use_automatic_sender_security

  4. DNS frequently asked questions – Mailgun Help Center

    Sections I created my records, but Mailgun does not see them · The DKIM record is verified, but the SPF is not verified · Why do I see multiple DKIM keys or DKIM keys in an Unverified state? · What is the DKIM authority and under what circumstances can I modify it? · Other (optional, but strongly recommended) DNS records

  5. Getting started Sending Email

    Sections The basic steps to verify a domain · Understanding multiple DKIM keys · Verify DNS settings

  6. RFC 7208 SPF

    Sections §4.6.4 · §3.2

  7. RFC 6376 DKIM

    Sections §3.5 · §6

  8. RFC 9989 DMARC

    Sections Identifier Alignment

[ Glossary ]

Glossary

Automatic Sender Security
Mailgun signing configuration that uses provider-supplied DKIM CNAME records.
DKIM authority
The domain used as the signing identity, which can differ from the sending subdomain.
Historical key
A retained DKIM entry that may not be the active signer.
Tracking CNAME
A hostname used for tracking features, separate from DKIM delegation.
Exact-route test
A controlled message sent through the same application configuration being approved.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base