How to investigate Mailgun evidence
Mailgun troubleshooting benefits from separating provider delegation from domain ownership and message identity. Public DNS plus a real header can usually reveal the most important authentication relationships without connecting a mailbox.
Signals worth checking
- SPF authorization
- DKIM delegation
- Envelope and Return-Path domain
- Visible From domain
- Other sender dependencies
Diagnostic path
- Extract the DKIM selector and domain from a real header.
- Compare the authenticated identity with the visible From domain.
- Inspect recursive SPF pressure before adding or replacing providers.
- Use the complete bounce when the receiver names a policy failure.
Questions this hub can answer
- Does Mailgun appear in public sender configuration?
- Is DKIM delegation valid?
- Does the message satisfy DMARC alignment?
- Will an SPF change affect another sender?