# Set up reliable email with Mailgun — LLM Prompt

> **How to use this file:** Paste the entire contents into Claude, ChatGPT, Gemini, or any LLM as your opening message. It gives the model the whole guide, so it can walk you through it, ask where you have got to, and help when something does not behave.
>
> *Source: [https://documentation.elmspark.com/guides/mailgun-email/](https://documentation.elmspark.com/guides/mailgun-email/)*

---

You are helping me with the following. Use this guide as your reference. Work through it with me, ask what I have already done, and help me troubleshoot. Where a step changes something on a live site, a domain, or a server, tell me what it will do and wait for me to confirm before we go on. If something here contradicts what I am actually seeing, say so rather than guessing.

**What this covers:** The complete guide to setting up Mailgun email delivery for a PageMotor site: every screen, every field, from account creation to inbox confirmation.

# Set up reliable email with Mailgun

The complete walkthrough: every screen, every field, from account creation to inbox confirmation.

▶ The shape of the job and every trap in it, 3 minutes 15 seconds, narrated, with captions. The ten steps below have every field.

**Read the narration instead**

**The region is locked for life.** EU or US, chosen once, per domain. A verified domain cannot be moved between regions afterwards, so pick the one your audience is actually in.

**Add it as a subdomain.** `mg.` then your domain. That keeps every Mailgun record separate from the email you already receive, so your existing mailboxes cannot break.

**The one that costs an afternoon.** On the Add Domain form Mailgun pre-selects *Self-manage DKIM keys*. Switch it to *Use automatic sender security*. The two options hand you completely different DNS records: automatic gives two CNAMEs that Mailgun rotates for you, self-manage gives a single TXT key you rotate yourself. Pick wrong and you cannot switch, you delete the domain and start again.

**Seven records.** One SPF, two DKIM CNAMEs, a tracking CNAME, and two MX for bounces. Copy the DKIM values from the screen: they carry a hash unique to your account and cannot be constructed.

**On Cloudflare, every record grey.** The orange proxy breaks email authentication, and it is the most common reason records verify happily while mail still fails.

**A pause that looks like a fault.** Every record can be green while sending still fails, because Mailgun activates the DKIM keys on its own servers after the CNAMEs validate. A yellow “unverified domain settings” warning during that window is normal and clears itself, usually inside five minutes.

**The sending key is shown once.** Copy it the moment it appears. Miss it and the only fix is to delete the key and create another. Gravity SMTP on WordPress needs the account-level Private API key instead.

**“Connected” is not “delivered”.** Mailgun saying active and the plugin saying connected only prove the credentials are valid. Proof is three things together: a real test email in a Gmail inbox rather than spam, mail-tester.com at 9 or 10 out of 10, and Mailgun’s own log showing Delivered.

Use this guide with any AI assistant

Download it as a prompt file, paste it into Claude, ChatGPT, Gemini or any LLM, and it will walk you through every step interactively.

## 1 Create your Mailgun account

Sign up at [mailgun.com](https://www.mailgun.com). Three fields, and you will be asked to verify your email address before you can do anything else — do that before continuing.

## 2 Add your sending domain

Once logged in, you land on the dashboard. Navigate to **Send → Sending → Domains** in the left sidebar. Your account starts with a sandbox domain — ignore that. You want to add your own domain.

On the Domains page, click **Add new domain**.

The **Add Domain** form opens. This form has four sections and one of them has a choice that will determine which DNS records you’ll need to add. Read every field below before you fill anything in.

### Field by field — what to enter

| Field | What to enter and why |
|---|---|
| Domain name | Enter `mg.yourdomain.com` — your real domain with `mg.` in front. For example: `mg.example.com`. The `mg.` prefix creates a dedicated sending subdomain. This keeps Mailgun’s records completely separate from the email you already receive on your main domain. It will not affect your existing email setup. |
| Domain region | ✓ EU — if you or your audience are in the UK or Europe ✓ US — if your audience is in North America This is where the region is chosen. It is locked per domain for life, so pick the one your audience is in. |
| IP type | ✓ Shared IP Dedicated IPs are for high-volume senders (50,000+ emails/month). Leave this on Shared unless you specifically need otherwise. |
| Security settings ← READ THIS | ✓ **Use automatic sender security** ✗ Self-manage DKIM keys |
| DMARC / Red Sift | ✓ Leave unticked You will enable DMARC properly in Step 7. Skipping this checkbox here is intentional. |

- Mailgun manages and rotates your DKIM signing keys automatically
- Better long-term deliverability with no maintenance
- Gives you **2 CNAME records** (pdk1 and pdk2) to add to DNS
- This guide’s DNS records table matches this option

- You get a static 1024-bit key you must rotate yourself manually
- Gives you **1 TXT record** instead of 2 CNAMEs — a completely different DNS record set
- If you pick this, the DNS records in Step 3 will not match what Mailgun shows you — you will need to start over

**If you already added the domain with the wrong option:** delete the domain in Mailgun (Domain Settings → Delete Domain), then add it again with “Use automatic sender security” selected.

Once you have filled in all fields correctly, click **Add Domain**. Mailgun will take a few seconds to create the domain and then show you the DNS records screen.

## 3 Copy the DNS records

After clicking Add Domain, you land on the DNS records screen. This shows every record you need to add to your domain’s DNS. Do not close this page.

If you chose “Use automatic sender security” in Step 2, you will see **7 records**: one SPF, two DKIM CNAMEs, one tracking CNAME, and two MX records. Here is what each one does:

| Type | Name / Host | Value | Purpose |
|---|---|---|---|
| TXT | `mg.yourdomain.com` | `v=spf1 include:mailgun.org ~all` | SPF — declares Mailgun is allowed to send for this domain |
| CNAME | `pdk1._domainkey.mg.yourdomain.com` | `pdk1._domainkey.<hash>.dkim5.eu.mgsend.org` | DKIM key 1 — cryptographic signature (copy exact value from Mailgun) |
| CNAME | `pdk2._domainkey.mg.yourdomain.com` | `pdk2._domainkey.<hash>.dkim5.eu.mgsend.org` | DKIM key 2 — second rotation key (copy exact value from Mailgun) |
| CNAME | `email.mg.yourdomain.com` | `eu.mailgun.org` | Tracking — enables open/click tracking (optional but recommended) |
| MX | `mg.yourdomain.com` | `mxa.eu.mailgun.org` (priority 10) | Bounce handling — lets Mailgun receive delivery failures |
| MX | `mg.yourdomain.com` | `mxb.eu.mailgun.org` (priority 10) | Bounce handling (second, redundant) |

## 4 Add the records at your DNS provider

Open your DNS provider in a separate tab and add each of the 7 records. Keep the Mailgun DNS screen open for reference.

**Adding records on Cloudflare**

1. Log in to Cloudflare → pick your domain → go to **DNS → Records**.
2. Click **Add record** for each of the 7 records.
3. **Critical: set every record to DNS Only (grey cloud, not orange).** The Cloudflare proxy (orange cloud) breaks email authentication. Click the orange cloud icon to toggle it to grey before saving each record.
4. For MX records: enter just the hostname in the Priority box (e.g. `10`) and the mail server address in the Content box.
5. For CNAME records: paste the full value Mailgun gives you including the trailing dot if one appears.

**Adding records on IONOS**

1. Log in to IONOS → go to Domains & SSL → click your domain → DNS.
2. Add each record using the Add Record button.
3. For CNAME records, enter the subdomain part only in the Host field (e.g. `pdk1._domainkey.mg` not the full `pdk1._domainkey.mg.yourdomain.com`).
4. IONOS may take up to 30 minutes to propagate changes.

**Adding records on GoDaddy**

1. Log in to GoDaddy → My Products → DNS → click your domain.
2. Add each record. GoDaddy expects CNAME values *without* a trailing dot.
3. For the Host field on GoDaddy, enter only the subdomain portion, not the full domain.

**Adding records on Namecheap**

1. Log in to Namecheap → Domain List → Manage → Advanced DNS.
2. Add each record. For the Host field, enter only the subdomain portion.

**Mailgun’s automatic setup (easiest if your provider is supported)**

On the DNS records screen in Mailgun, look for the **Automatic setup** card at the top. It reads “Log in to your provider”. Mailgun supports Cloudflare, GoDaddy, Bluehost, and others. If your provider appears in the list, click it and follow the authorisation flow — Mailgun adds every record for you in one step and you can skip the manual steps above entirely.

## 5 Verify the domain in Mailgun

Once all records are added at your DNS provider, return to Mailgun and click **Check Status** (or **Verify DNS Settings**) on the DNS records page. Each record should change from a red cross to a green tick.

## 6 Wait for DKIM activation

This step catches people out. Even after all DNS records show as “Verified” in Mailgun’s interface, sending may not work yet. Mailgun needs to activate the DKIM signing keys on its own servers, and it does this asynchronously after the CNAMEs validate. It typically takes 30 seconds to 10 minutes.

On the domain settings page, you may see a yellow warning like “Unverified domain settings” even though all records are green. That warning clears automatically once DKIM is fully active. Refresh the page every few minutes until the warning disappears.

## 7 Enable DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with messages that fail authentication, and where to send reports. You want this configured before you send any real email.

In your Mailgun domain settings, scroll to the **Authentication records** section near the bottom and click **Enable DMARC**. Mailgun generates a TXT record value for you.

- Domain settings
- Sending records
- Receiving records
- Tracking records
- Authentication records ← scroll to the bottom

Copy the TXT record value Mailgun gives you. It will look something like:

`v=DMARC1; p=none; pct=100; fo=1; ri=3600; rua=mailto:…@dmarc.mailgun.org; ruf=mailto:…@dmarc.mailgun.org;`

Go back to your DNS provider and add a new TXT record:

- **Name / Host:** `_dmarc.mg.yourdomain.com`
- **Value:** the full string Mailgun gave you

Then return to Mailgun and click **Check Status** again. The DMARC row should turn green.

## 8 Create a sending key

The sending key is the credential that lets your site actually send email through Mailgun. It is scoped to this specific domain, which means even if it were ever compromised it could only be used to send from your one domain.

In your Mailgun domain settings, click the **Sending keys** tab, then **Add sending key**.

1. Give it a memorable name, for example `pagemotor-site`.
2. Click **Create sending key**.
3. **Copy the key the moment it appears.** Mailgun shows it exactly once. If you miss it, you have to delete the key and create a new one.

## 9 Connect your site

**PageMotor — EP Suite plugins**

You need two plugins: **ep-email-mailgun** (handles transactional email: contact forms, password resets) and **ep-newsletter-mailgun** (handles newsletter campaigns). Install both even if you do not plan to use newsletters right away.

1. In PageMotor admin, go to **Plugins → Manage Plugins → Upload**.
2. Upload `ep-email-mailgun.zip`. Activate it.
3. Upload `ep-newsletter-mailgun.zip`. Activate it.
4. Open each plugin’s settings and fill in: **Sending Key** — the key you copied in Step 8
5. **Sending Domain** — `mg.yourdomain.com`
6. **Region** — EU or US, matching what you chose for the domain in Step 2
7. Click **Test Connection**. It should turn green.
8. In **EP Email → SMTP Configuration**, set the transport to **Mailgun**.
9. In **EP Newsletter → Email Delivery**, set the driver to **Mailgun**. Also make sure ep-newsletter-mailgun appears *before* ep-newsletter in the plugin load order — otherwise the newsletter driver will not be picked up.

**WordPress — Mailgun official plugin (recommended for most users)**

1. In WordPress admin, go to **Plugins → Add New** and search for “Mailgun”. Install the official plugin by Mailgun.
2. Activate it, then go to **Settings → Mailgun**.
3. Fill in: Region, Domain Name (`mg.yourdomain.com`), API Key (from Step 8), From Address, From Name.
4. Set **Use API** to Yes.
5. Save, then click **Test Configuration**.

**WordPress — Gravity SMTP (if you have a Gravity Forms licence)**

1. Download Gravity SMTP from your Gravity Forms account and install it in WordPress.
2. Go to **Gravity SMTP → Settings → Integrations** and add Mailgun.
3. Use the **account-level Private API key** from Mailgun Settings → API Security (not the domain-scoped sending key).
4. Fill in the sending domain, region, and From address.
5. Save and set Mailgun as the Primary integration.

## 10 Test it really works

Mailgun saying “domain active” and the plugin saying “connection successful” only mean the credentials are valid. They do not prove a single email will land in an inbox. This step is the only thing that does.

**Send a real test email.** Use the plugin’s test button or fill in and submit a real contact form on your site. Address it to a Gmail inbox you can open.

**Check the email lands in Inbox, not Spam.** Open Gmail. If the email went to Spam, it is not set up correctly yet. If it landed in Inbox with no “Be careful with this message” warning, you are close.

**Run a mail-tester check.** Go to [mail-tester.com](https://www.mail-tester.com), copy the one-off address it gives you, and send it a real test email through your site. Then click “Then check your score”. Aim for **9 or 10 out of 10**. Any lower and mail-tester will tell you exactly what is still misconfigured.

**Check the Mailgun event log.** In Mailgun, go to **Reporting → Logs**. Find your test message. It should show: Accepted then Delivered . SMTP code 250. If it shows “Failed” or “Rejected”, there is still a configuration problem.

## Troubleshooting

Open these only if you hit them.

**My test email lands in Spam**

Usually it means DKIM is not fully active yet (Step 6). Wait a few more minutes and resend. Also: make sure your From address uses your own domain, not a free address like gmail.com. Run a mail-tester.com check — it will name whatever specific thing is still missing.

**Mailgun shows “Verified” but sending fails**

After records verify, Mailgun still needs a few minutes to activate the DKIM keys on its own servers. The domain overview page may show a yellow “Unverified domain settings” warning even though all DNS rows are green. This is the DKIM activation lag described in Step 6. Wait and refresh.

**I see only 1 TXT-based DKIM record, not 2 CNAMEs**

You chose “Self-manage DKIM keys” in Step 2 instead of “Use automatic sender security”. This guide’s DNS records table does not match that mode. The fix: go to Domain Settings → delete the domain, then add it again with the correct option selected. The 1-TXT mode does work technically, but it means different DNS records to add.

**Duplicate SPF or DMARC warning**

There can only be one SPF record and one DMARC record per DNS name. Edit the existing record rather than adding a second one. This guide uses a subdomain (`mg.`) which means you should never clash with records on the apex domain, but if you added the records to the wrong place it can happen.

**Cloudflare records show as verified but mail still fails**

Most likely the Cloudflare proxy is still on for one or more records (the orange cloud icon). All email-related DNS records must be **DNS only (grey cloud)**. Click the orange cloud for each Mailgun record in Cloudflare and toggle it to grey, then click Save.

**I chose the wrong region during signup**

The region is locked per domain for life. Your options are: (a) if you have not sent any email yet, delete the domain, delete the Mailgun account, and create a new one with the correct region; or (b) create a second Mailgun account in the correct region and use that for the domain going forward. You cannot move an existing verified domain between regions.

**I am on WordPress with Gravity SMTP and it says “invalid API key”**

Gravity SMTP does not accept domain-scoped sending keys (the kind created in Step 8). You must use Mailgun’s account-level Private API key instead. In Mailgun, go to the main **Settings** menu (top-level, not Domain Settings), then **API Security**, and copy the Private API key from there.

**Mailgun’s “Send to a Coworker” email is missing the pdk1 / pdk2 CNAME rows**

This is a known issue with Mailgun’s setup email template when using “automatic sender security” mode. The email shows 5 records but your domain needs 7. The two missing pdk1 and pdk2 CNAME records are real and required — they are just missing from the email template. Get the correct values by logging in to Mailgun and reading them directly from the DNS records screen. Do not use the coworker email as your source of truth.

---

*Generated from the guide above. If something here looks wrong, the guide is the source of truth: https://documentation.elmspark.com/guides/mailgun-email/*