Configure Mailgun with a Cloudflare-Managed Domain

Overview

This guide explains how to set up Mailgun for sending email from a domain whose DNS is managed by Cloudflare. The process involves creating a Mailgun account, adding your sending domain, and configuring the required DNS records within Cloudflare's dashboard.

What You'll Need

• A Mailgun account.
• A domain name added to your Cloudflare account.
• Access to the Cloudflare DNS management panel.

Step 1: Add Your Domain in Mailgun

After logging into your Mailgun account, navigate to the section for managing sending domains. Click the option to add a new domain.

You can choose to set up your primary domain (e.g., yourcompany.com) or a dedicated subdomain (e.g., mail.yourcompany.com). For most setups, using a subdomain is recommended, especially if your primary domain is already used with another email service like Google Workspace.

Important: When prompted, select the US region for your domain setup, not the EU region. After entering your domain name, proceed. Mailgun will then display a screen listing the specific DNS records you need to create. Keep this screen open for reference.

Step 2: Access DNS Records in Cloudflare

Log into your Cloudflare dashboard and select the domain you are configuring. Navigate to the DNS section, then Records. You will create all new records by clicking the + Add Record button.

Step 3: Add the SPF (TXT) Record

Create a new DNS record with the following details:

• Type: TXT
• Name: Enter @ if configuring your primary domain. If using a subdomain (e.g., mail.yourcompany.com), enter only the subdomain part (e.g., mail).
• Content: v=spf1 include:mailgun.org ~all

Save the record.

Step 4: Add the DKIM (TXT) Record

Click + Add Record again to create a second TXT record.

• Type: TXT
• Name: This value is unique to your Mailgun setup. Copy the hostname provided by Mailgun for the DKIM record. It will look similar to mx._domainkey.yoursubdomain or mailo._domainkey. Enter only the part before your root domain (e.g., for mx._domainkey.mail, you would enter mx._domainkey.mail).
• Content: Paste the long, unique DKIM key value provided by Mailgun.

Save the record.

Step 5: Add the First MX Record

Create a new record for mail routing.

• Type: MX
• Name: Use @ for your primary domain or the subdomain name (e.g., mail) for a subdomain.
• Mail Server: mxa.mailgun.org
• Priority: 10

Save the record.

Step 6: Add the Second MX Record

Create another MX record for redundancy.

• Type: MX
• Name: Same as the previous MX record (@ or your subdomain name).
• Mail Server: mxb.mailgun.org
• Priority: 10

Save the record.

Step 7: Add the CNAME Record (Critical Cloudflare Step)

Create the final required record.

• Type: CNAME
• Name: Copy the hostname provided by Mailgun for the CNAME record. It will be something like email.mail or just email. Enter only the part before your root domain.
• Target: mailgun.org

Essential Cloudflare Setting: Before saving, you must click the orange cloud icon next to this record to switch its status from Proxied to DNS only (the icon will turn gray). If this record remains proxied, Mailgun will not be able to verify it, and email delivery will fail.

Save the record.

Step 8: Verify Setup in Mailgun

Return to the domain setup screen in your Mailgun account. Click the button to verify your DNS settings. DNS changes can take some time to propagate globally. If any records show as unverified, wait a few minutes and click the verify button again.

Once all records are verified, you can retrieve your Mailgun API keys from your account settings to configure email sending in your CRM.

Frequently Asked Questions

Why must the CNAME record be set to "DNS only" in Cloudflare?

Cloudflare's proxy service modifies how web traffic reaches your domain, which interferes with Mailgun's ability to correctly verify the CNAME record. Setting it to "DNS only" allows Mailgun to see the record directly.

Do the TXT and MX records also need to be "DNS only"?

No. In Cloudflare, TXT and MX records are not eligible for proxying, so this setting does not apply to them. Only the CNAME record requires this specific adjustment.

Will this affect my existing Google Workspace or other email?

If you configure Mailgun using a subdomain (e.g., mail.yourcompany.com), it will not interfere with email services on your primary domain (e.g., yourcompany.com). Using your primary domain for both services is not recommended unless you understand the specific routing implications.