How to set up DKIM for Mailgun

DKIM signs your outgoing mail with a key only your sender holds, and publishes the matching public key in DNS. It can't be generated by a checker — the key comes from Mailgun's console — so this guide walks the console flow and the record you'll publish.

What you'll publish: Classic mode: a TXT record at <selector>._domainkey on your sending domain — the selector is generated per domain, so copy the exact name and value from the dashboard. Automatic Sender Security mode uses two CNAMEs (pdk1/pdk2._domainkey) that Mailgun rotates automatically.

Steps

1. In the Mailgun control panel, open Sending → Domains and add (or select) your sending domain.
2. Open Domain settings → DNS records — the Domain Verification & DNS section lists the exact DKIM record(s) for this domain.
3. Publish them at your DNS provider, then use Verify DNS settings.

Gotchas

• ⚠Mailgun has no universal default selector — every domain gets its own. Always copy from the dashboard.
• ⚠Multiple DKIM keys may be listed with some showing Unverified — Mailgun doesn't require all of them to verify.

Steps verified against Mailgun: DKIM security on 2026-07-17.