MailFixIt

Mailgun email configuration guide

Mailgun: DKIM record not verifying

Mailgun cannot verify the expected DKIM record, or the message is signed with a selector or domain different from the one you checked.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

The DNS record does not exactly match the value Mailgun issued for this sending domain, or the tested message uses another selector or signing domain.

Fix it

  1. Open the exact domain in Mailgun and confirm its region and verification status.
  2. Copy the DKIM record name, type, and complete value from that domain’s DNS records screen.
  3. Publish it in the authoritative DNS zone without adding the domain twice, truncating the key, or changing CNAME to TXT.
  4. Remove a record only when it conflicts at the same selector; other selectors may belong to active senders.
  5. Ask Mailgun to verify again, send a new message, and confirm its d= and s= values resolve and produce dkim=pass.

Common mistake

Verifying one Mailgun subdomain does not authenticate a different sending domain. A public key also does not prove that the Mailgun account is using it.

What MailFixIt can check

MailFixIt can inspect public DKIM data for the selector you provide. It cannot see Mailgun account state or select the correct region for you.

Use the related DKIM guide when the public key is missing or malformed.

Frequently asked questions

What does MailFixIt check for Mailgun?

It can query the public key for a supplied selector and report malformed or missing DKIM data. Mailgun must confirm domain verification and active signing.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Mailgun official setup guidance.