MailFixIt

Mailgun email configuration guide

Mailgun: SPF record for provider sending

SPF checks the Mailgun envelope MAIL FROM domain, which may be a subdomain and may differ from the visible From address.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

The SPF policy at the Mailgun envelope domain is missing, duplicated, or does not authorize the Mailgun sending route.

Fix it

  1. Open the exact sending domain in Mailgun and copy its current SPF requirement.
  2. Read a failed or delivered message header to identify the envelope MAIL FROM or Return-Path domain.
  3. At that DNS name, keep one TXT record beginning with v=spf1 and merge Mailgun’s mechanism with other legitimate senders.
  4. Do not place the record only at the visible From domain if Mailgun evaluates a dedicated subdomain.
  5. Publish it, ask Mailgun to verify again, and confirm spf=pass in a new message.

Common mistake

Two SPF records cause a permanent evaluation error. A correct SPF record at the wrong domain is still irrelevant to the message Mailgun sent.

What MailFixIt can check

MailFixIt can trace the public SPF policy and show authorization for resolved sending IPs. It cannot prove Mailgun account state without a new message.

Use the related SPF guides for subdomain, include, syntax, or lookup-limit failures.

Frequently asked questions

What does MailFixIt check for Mailgun?

It can find duplicate policies, syntax errors, failing includes, and visible authorization. The message header is needed to confirm which envelope domain Mailgun used.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Mailgun official setup guidance.