How do I set up Mailgun so its email passes DMARC?

What does Mailgun ask me to publish?

Verified domains are not subject to a sending limit of 300 emails per day No more "sent via Mailgun.org" message in your emails

Mailgun prints these values in its own documentation, the same for every customer.

Mailgun makes the other values for your account, so we do not print them here.

Mailgun also gives MX records, for the replies and bounces it receives. Add them only at the name Mailgun shows you, never at your domain itself: the MX records at your domain decide where all of your email is delivered.

include:mailgun.org

Where in Mailgun are my values shown?

Find this record in the "Domain Verification & DNS" section of the Mailgun control panel for your domain.

In Mailgun, open the Domain Verification & DNS section of the control panel for your domain.

Copy each value from there exactly as shown, and add each record at your DNS host.

How do I add Mailgun to the SPF record I already have?

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".

Add include:mailgun.org inside the one SPF record you have, before its last word, and keep every service already in it. Never add a second SPF record: two make the check fail for every message.

Will p=reject block Mailgun email?

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment

Not once Mailgun signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Mailgun gives you are on your domain.

Before you raise your policy, read your DMARC reports and check that email from Mailgun passes.