Secure Subdomain Delegation in Mailgun

Why subdomain delegation in Mailgun needs secure handling

You’ve set up a subdomain for a campaign or app. It’s working. Then you realize: if someone else gains access to that subdomain’s configuration, they could send as your domain—without your knowledge.

Subdomains in Mailgun aren’t just technical containers; they’re reputational gateways. Misconfigure one, and spam filters see your entire domain as unreliable. Defer access too freely, and you risk abuse from unintended sources. Leave access active after a project ends, and you leave a backdoor open for credential leaks and unauthorized mail.

Secure delegation isn’t about restricting access—it’s about controlling it with precision. This guide walks you through how to safely delegate and later revoke subdomain access in Mailgun, so you protect sender reputation without blocking legitimate use.

Key takeaways

Delegating a subdomain in Mailgun extends your sender reputation to that domain—misconfiguration can trigger blocklists.
Unrestricted delegation risks abuse by third parties who may send spam using your domain.
Revoke subdomain access promptly after project completion to reduce exposure to credential leaks and unauthorized sending.

How does Mailgun subdomain delegation work at the DNS level?

You delegate a subdomain in Mailgun by publishing SPF, DKIM, and DMARC DNS records that authorize the subdomain to send email on your behalf. Each delegated subdomain operates as an independent sender domain, requiring its own set of DNS records to avoid rejection by recipient servers. This ensures that messages appear legitimate and traceable, reducing spam risk and preserving sender reputation.

SPF, DKIM, and DMARC: The DNS foundation

When you set up a subdomain in Mailgun, you’re not just adding a new email address — you're creating a new sender identity. To make it work, you must configure three DNS records: SPF to authorize which servers may send on the subdomain’s behalf, DKIM to sign each message with a cryptographic key, and DMARC to define how receivers should act if either SPF or DKIM fails. Without all three, inbound mail servers will reject your messages or flag them as spam.

SPF allows you to list only Mailgun’s servers as valid senders. DKIM adds a digital signature that verifies message integrity. DMARC sits on top, telling receivers what to do when a message fails SPF or DKIM — typically to quarantine or reject. These are industry-standard protocols. For a deeper look at how they work, the IETF’s RFC 7052 outlines best practices for DMARC deployment.

Because each subdomain needs its own set of records, you can't reuse SPF policies across subdomains. Doing so may break authentication or cause unintended senders to gain access. You must manage each subdomain’s DNS settings individually, ideally with the help of a DNS provider that supports bulk record management or integration with a verification service.

Why delegation matters for external services

Let’s say you’re using a CRM or a marketing automation tool that sends transactional emails. Instead of sending from your primary domain, you delegate a subdomain like marketing.yourcompany.com to the tool via Mailgun. That tool can now send mail through Mailgun’s systems, using your authorized domain — but independently. This separation prevents your primary domain’s reputation from being dragged down by a third-party tool’s inconsistent sending behavior.

It also gives you control: you can revoke access at any time by removing the DNS records or disabling the subdomain in Mailgun. When revoked, the subdomain stops functioning for sending — no more messages can be sent from it, even if the external system still attempts to route through it. This makes delegation both powerful and safe.

For teams managing large email lists, verifying the validity of these subdomains and their associated recipients is a critical step. Tools like MailTester’s bulk verification can help ensure that all addresses tied to a subdomain are deliverable and not disposable, reducing bounce rates and protecting your sender reputation. You can also test deliverability before sending by using MailTester’s inbox placement tool.

What risks are tied to unsecured subdomain delegation?

Delegating a subdomain without proper controls exposes your entire domain to spam reputation damage. If the subdomain is compromised, spammers can send through it, and your main domain’s reputation may suffer — even if you didn’t send the messages. This can lead to blacklisting, delivery failures, and lost sender credibility.

Spam reputation damage spreads across domains

When you delegate a subdomain to a third party, you’re essentially handing them a piece of your mail infrastructure. If they send spam, use poor authentication, or fail to manage bounces, the mail servers that flag them may mark your parent domain as problematic too. This happens because reputation metrics often track domains at the top-level or subdomain level, especially when they share infrastructure.

Research from Spamhaus shows that domains associated with known spam sources are routinely blocked — even if only one subdomain is misused. This means a single vulnerable subdomain can trigger mass blocking across email providers.

Spam traps and blacklisted IPs aren’t isolated

Poorly managed subdomains often use shared or poorly monitored IP addresses. If those IPs host spam traps — old, inactive email addresses set up to detect spam — your delegation can trigger a red flag. Even one spam-trap hit can hurt your sender score, especially if the IP is known for bad behavior.

Mailgun’s own guidelines emphasize that delegated subdomains must follow strict authentication and content policies. Without that, you risk poisoning your sender reputation through indirect exposure.

Increased attack surface for spoofing and phishing

A misconfigured subdomain becomes a potential spoofing target. Attackers can send emails that appear to come from your domain by exploiting weak DNS or authentication settings. This undermines trust and increases the chance of your emails being flagged as phishing.

According to the Anti-Phishing Working Group (APWG), over 80% of phishing attacks leverage trusted domains through subdomain abuse. Without tight controls, you’re making it easier for attackers to impersonate your brand.

Let’s be clear: delegation isn’t inherently risky — it’s a standard practice. But it only works when you enforce strong verification, monitor deliverability, and have a way to revoke access when needed. That’s why tools like bulk email verification and inbox placement testing are essential for checking the health of your sender infrastructure before and after delegation.

How to securely delegate a subdomain in Mailgun: a step-by-step process

You can securely delegate a subdomain in Mailgun by creating a dedicated subdomain, configuring SPF with strict alignment, setting up a unique DKIM key, enforcing DMARC with reporting, restricting access to trusted IPs and services, and validating delivery with inbox placement testing. This process reduces spoofing risk, improves sender reputation, and ensures only authorized systems can send from the subdomain.

Step-by-step setup

Create a dedicated subdomain (e.g. marketing.yourdomain.com) in your DNS zone and add it to your Mailgun control panel. This isolates email activity from your main domain, limiting blast radius if credentials are compromised. Use a subdomain that reflects the sending purpose, such as newsletter.yourdomain.com or support.yourdomain.com.
Configure SPF with strict alignment. Set SPF records to include only the IP ranges or services authorized to send on behalf of the subdomain. Use -all as the qualifier to reject all unlisted sources. This prevents unauthorized senders from impersonating your subdomain. See RFC 7208 for the full specification.
Generate a unique DKIM key pair in Mailgun for the subdomain. Select a distinctive selector (e.g. marketing) so keys aren’t shared across domains. DKIM verifies message integrity and origin. It’s a standard industry practice—most major inboxes use DKIM as a core validation signal.
Set up DMARC with enforcement. Align both SPF and DKIM, and set p=reject to block all non-compliant messages. Include a reporting policy (e.g. ruf=mailto:[email protected]) to collect forensic data from receiving providers that evaluate your subdomain’s reputation.
Restrict access to authorized services only. Use Mailgun’s API key permissions to limit the subdomain’s access to specific apps, IP addresses, or APIs. Never use overly permissive keys. Consider using a dedicated API key scoped to the subdomain.
Test delivery before enabling. Use Mailgun’s inbox placement tools or validate list quality with a service like MailTester. Run deliverability tests on real inboxes using MailTester’s inbox placement tester to identify issues before full rollout.

Verify and monitor

After setup, continuously monitor DMARC reports and inbox placement scores. Use MailTester’s bulk verification tool to clean sender lists and ensure only valid addresses are used. This reduces bounce rates and helps maintain a good sender reputation over time. Always revoke access when a service no longer needs to send from the subdomain—this is as important as setting up access in the first place.

When and how to revoke subdomain access in Mailgun

You should revoke subdomain access in Mailgun immediately after a project ends or a team member leaves. Failure to do so risks unauthorized email sending, spam exposure, and damage to your sender reputation. Revoke access by removing the subdomain from your DNS configuration, updating SPF and DMARC, and monitoring for suspicious outbound messages using Mailgun’s event webhooks or third-party tools.

Step-by-step revocation process

Remove the subdomain from Mailgun’s authorized sources in your Mailgun dashboard. Go to Settings → Domains, locate the subdomain used for the project or team member, and delete it. This prevents any further email sending from that subdomain.
Update your DNS configuration to remove the subdomain’s TXT and SPF records. You might still have an SPF record that includes the subdomain’s IP or domain. Removing it ensures that no email from that identity can be authenticated.
Revise your SPF record to exclude the revoked subdomain. SPF is strict about alignment—any inclusion of a dead or revoked subdomain can cause genuine messages to fail. Use the SPF specification as reference for proper syntax.
Review and adjust your DMARC policy. If you run DMARC (recommended), ensure your policy (p=quarantine or p=reject) continues to report on existing domains. You don't need to change it outright, but remove the revoked subdomain from any include clauses.
Monitor outbound activity using Mailgun’s event webhooks or a third-party tracking tool like MxToolbox. Set up logging for rejected, bounced, or unauthorized sends. This lets you catch any anomalies post-revocation, such as spoofing attempts.

Additional safeguards

Let’s be clear: even after revoking access, emails sent from a revoked subdomain before deletion may still appear in inboxes if they were delivered. But you can prevent new abuse. Use tools like Mailgun inbox placement tests to check if your current domain remains trusted. For large sends, run bulk verification to catch obsolete or compromised addresses before sending.

“Domain and subdomain misuse is one of the top entry points for sender reputation damage.” — Spamhaus

When in doubt, verify your configuration with a DNS zone checker. Tools like MxToolbox or the RFC-defined SPF validation process can help you spot lingering entries. Keep records of access logs and revocation dates for audits. Once done, you’ve reduced exposure—no more lingering keys in the digital door.

How to audit subdomain delegation and detect anomalies

You must verify DNS records, monitor email activity, and test deliverability regularly to catch unauthorized subdomain use or misconfigurations early. Use tools to check SPF, DKIM, and DMARC; review logs for odd sends; validate domains against known bad patterns; and simulate inbox placement to detect drops before they impact your reputation.

DNS and configuration checks

Use a DNS lookup tool like MxToolbox to confirm the exact SPF, DKIM, and DMARC records for your subdomain. Even a single misconfigured entry can allow spoofing or cause bounces.
Check that your subdomain’s SPF record includes only authorized senders—never allow include:_spf.unauthorized.com without verification.
Ensure DMARC policies are set to none during testing, but move to quarantine or reject once you’re confident in your setup.

Activity monitoring and validation

Review Mailgun’s event webhooks or logs monthly. Look for sends from your subdomain that don’t match expected patterns—e.g., high volume from a single IP or unexpected geolocation.
Use a real-time email verification API to flag role accounts like admin@, postmaster@, or temporary domains commonly used in automated abuse. These often trigger spam filters.
Run inbox placement tests with tools that simulate real user inboxes—these catch issues like poor spam score or blacklisting before you send to real users.

Deliverability issues often start with small missteps. A single compromised subdomain can damage your sender reputation across multiple providers.

“DNS misconfigurations are among the top reasons for email delivery failures.” — RFC 7230: HTTP/1.1

For teams managing large lists, integrating a tool like MailTester’s bulk verification helps catch risky addresses before they’re sent. You can also use the verification API in your workflows to validate addresses in real time. Regular testing through inbox placement tools ensures your messages land where they should—the inbox, not the spam folder.

Revoke subdomain delegation immediately if you detect unauthorized use. Use your provider’s API or dashboard to disable it, then audit why it happened. Prevention is cheaper than reputation recovery.

The role of email-verification in maintaining secure subdomain hygiene

You can’t securely delegate a subdomain for Mailgun if your email list contains invalid, disposable, or role-based addresses. These increase spam complaints, bounces, and degrade sender reputation—making subdomain abuse more likely. Email-verification ensures only valid, deliverable addresses are used, minimizing risk and protecting your domain’s trustworthiness.

Spam risks from poor list quality

Every invalid or disposable address added to a campaign is a potential complaint or bounce. Even a small number of such addresses can trigger filters on email providers like Gmail or Outlook. High bounce rates or spam complaints signal poor list hygiene, leading to IP or subdomain throttling.

Role accounts like sales@ or admin@ are often catch-alls or unmonitored. Sending to them doesn’t deliver value, and repeated sends can flag your sender reputation. Disposable email domains (like tempmail.org) are especially risky—they’re used by spammers and bots, and their use correlates with increased delivery failure rates.

MailTester as a safeguard

Using MailTester’s bulk verification helps you catch these risks before they impact your Mailgun campaigns. It flags invalid addresses, disposable domains, catch-alls, and role accounts with up to 98.9% accuracy. This means you’re not just reducing bounces—you’re protecting your sender reputation at scale.

Let’s say you’re launching a new campaign via a subdomain. Without verification, you might send to 20% invalid addresses. That’s not just wasted sends—it’s a reputation hit. With MailTester, you clean the list first. Only valid, high-quality addresses get sent.

Use MailTester’s bulk verification to check your entire list in seconds. You can also integrate directly with Mailgun via our Mailgun integration, ensuring every new list is validated before it ever hits your subdomain.

High-quality lists mean fewer complaints, fewer bounces, and stronger deliverability. When you delegate a subdomain, you’re not just moving traffic—you’re extending your sender’s trust. Verification is the foundation of that trust.

For testing delivery reliability, use MailTester’s inbox placement test to see how your messages land across real inboxes—including spam filters on Gmail, Outlook, and Apple Mail. This gives you real-world confidence before sending at scale.

For ongoing validation, the real-time verification API works with your signup flows, catch bad data at the source. No more “invalid” errors down the line.

Remember: a secure subdomain isn’t just about configuration—it’s about the data you send through it. Clean lists from verified sources reduce risk, improve inbox placement, and protect your long-term deliverability. That’s how you maintain secure subdomain hygiene.

How MailTester supports secure subdomain use in production workflows

You can verify every inbound email address in real time before sending through your Mailgun subdomain, ensuring only valid, deliverable addresses receive messages. Use the in-app AI assistant to diagnose bounces tied to subdomain routing or DNS mismatches, test inbox placement across Gmail, Outlook, and Apple Mail, and audit new list imports or post-revocation checks with 100 free credits — all without added cost or risk to your sender reputation.

Prevent delivery failures at the source

Integrate MailTester’s real-time verification API during signup or campaign workflows to catch invalid, disposable, or role-based emails before they hit Mailgun.
Verify domains and subdomains using the API to catch issues like missing MX records, catch-all configurations, or DNS misalignment early.
Test deliverability against Gmail, Outlook, and Apple Mail using the inbox placement tester — critical for validating subdomain-specific delivery rules or quarantine behaviors.

Debug and validate with confidence

Use the in-app AI assistant to parse bounce responses tied to your subdomain, especially for transient or greylisted results — it identifies whether a failure stems from email content, sender reputation, or subdomain misconfiguration.
Leverage the bulk verification tool to audit imported lists before sending through a specific subdomain, reducing the risk of trigger-based blacklists.
Run post-revocation checks on email lists using your 100 free credits — this ensures no previously valid addresses are now unsafe due to expired or mismanaged subdomains.
Refer to industry-standard best practices for sender authentication, such as SPF, DKIM, and DMARC — these are critical when routing emails through subdomains. See the SPF specification and DKIM specification for technical guidance.

Deliverability isn’t just about sending — it’s about knowing what gets through. Real-time validation and post-send testing reduce risk without slowing down your workflow.

A well-secured subdomain relies on consistent data hygiene and proactive monitoring. MailTester doesn’t just verify — it helps you fix the chain, from first contact to inbox placement. And with no expiry on purchased credits, you can scale audit cycles without budget friction. Start with 100 free verifications at MailTester’s pricing page.

Industry-standard practices for delegation and revocation

You should delegate subdomain access in Mailgun only when necessary, using short-lived credentials and strict access controls. Revoke access immediately when the task ends, and maintain a clear audit trail. This minimizes risk even if keys are compromised, aligns with security frameworks like NIST and OWASP, and ensures compliance with least-privilege principles.

Core checklist for secure subdomain delegation and revocation

Apply the principle of least privilege: never grant full access. Use granular roles—like read-only or send-only—and limit access to only the specific subdomains needed.
Use short-lived API keys with automatic expiration (e.g., 1–7 days), and rotate them regularly. Long-lived keys increase exposure; systems like AWS IAM or HashiCorp Vault enforce this by design.
Keep a master inventory of all delegated subdomains, who has access, the purpose, and expiration dates. Audit this list monthly or on each major change.
Automate revocation using CI/CD pipelines: when a project ends or a deployment finishes, the pipeline should deactivate the associated API key or subdomain access, reducing manual error.
Integrate access revocation with ticketing or project-management systems. If a support ticket closes or a feature is deprecated, the system should trigger access removal.
Use role-based access control (RBAC) and audit logs to track changes. Log every delegation and revocation event—this is essential for compliance and forensic analysis.

Why these practices matter

According to the NIST Special Publication 800-53, access control should be dynamic and time-bound. Static, long-lived keys are a common attack vector in breach scenarios. A system that enforces time-limited access reduces the window of compromise, even if credentials are leaked.

Let’s be clear: just because a subdomain works today doesn’t mean it should remain active forever. The moment a project ends, the access should follow. Tools that don’t support automated revocation create backlog risk. Use infrastructure-as-code practices to codify and enforce this.

For teams managing large email flows, consider pairing this with real-time deliverability checks. Validate recipient lists before sending, using a tool like MailTester’s bulk verification to catch invalid, role-based, or disposable email addresses before they waste send capacity or hurt sender reputation.

What to do if a delegated subdomain gets compromised

If a delegated subdomain is compromised, act immediately: remove it from your SPF and DKIM records, revoke DNS access, audit logs for unusual send volume or invalid addresses, notify Mailgun support, and re-validate your entire list using a trusted verification service. This stops abuse, protects your sender reputation, and prevents further damage.

Immediate containment steps

Remove the subdomain from SPF and DKIM configurations. A compromised subdomain can be used to send messages that appear to come from your domain. Removing it from SPF and DKIM ensures no forged emails can claim legitimacy. This step is critical—without it, malicious actors keep using your brand's trust.
Revoke DNS access to the subdomain. If the subdomain was delegated via DNS, update your DNS settings to remove or restrict access. This prevents unauthorized changes and stops attackers from hijacking the subdomain again.
Check your audit logs for anomalies. Look for sudden spikes in email volume, high bounce rates, or messages sent to clearly invalid addresses. Suspicious activity often shows up here. According to RFC 7001, proper logging is a recognized best practice for sender accountability.

Recovery and hygiene

Contact Mailgun support immediately. Report the abuse and request an investigation. Mailgun can track the origin of outbound traffic and help determine whether the subdomain was used for mass spam or phishing. While they don’t handle all abuse reports instantly, timely alerts increase priority.
Re-run your list hygiene using MailTester. Compromised or leaked lists may contain fake, outdated, or malicious addresses. Use MailTester’s bulk verification to clean your list. It checks for invalid, disposable, role-based, and catch-all addresses—helping you avoid being flagged as spam. This process ensures your list stays lean and deliverable.

After cleanup, review your subdomain delegation policy. Only delegate subdomains to trusted services with strict access controls. Re-enable only after confirming no residual risk. A single weak link can harm your entire domain reputation.

Conclusion: Secure delegation is proactive, not reactive

Delegating subdomains in Mailgun enables scalable, targeted email operations—but only when done with strict control over DNS configurations and policy alignment.

Secure delegation isn’t about setting it once and forgetting it. It requires continuous oversight, timely revocation when access is no longer needed, and consistent monitoring to protect your sender reputation and prevent abuse.

By validating every email address before delivery—especially those tied to delegated subdomains—you reduce bounce rates and prevent your domain from being flagged. Tools like MailTester help maintain data integrity by catching invalid or risky addresses early, minimizing exposure.

Sources

The platform-wide average cold email reply rate is 3.43%, while the top 25% of senders achieve 5.5%+ and the top 10% reach 10.7%+, based on billions of emails sent in 2025. — Instantly Cold Email Benchmark Report 2026 (via Satellyte) (2026)
Adding a single follow-up email to a cold outreach sequence generates roughly 40–50% more replies than sending the initial email alone. — Instantly Cold Email Reply Rate Benchmarks (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I delegate multiple subdomains in Mailgun at once?

Yes, but each subdomain must have its own SPF, DKIM, and DMARC policy to ensure deliverability and security.

How do I know if a subdomain is being abused?

Monitor Mailgun event logs for spikes in email volume or delivery failures. Use email-verification tools to filter out invalid or disposable addresses.

Does Mailgun support automatic subdomain revocation?

No, revocation is manual. Use DNS changes and configuration updates to disable access immediately.

What happens if I remove a subdomain from SPF without revoking access?

Emails sent from that subdomain may fail authentication, leading to bounces and potential reputational harm.

Can I reuse a revoked subdomain?

Yes, but only after reconfiguring DNS records, setting new SPF/DKIM policies, and verifying deliverability.

Is DMARC necessary for subdomain delegation?

Yes. DMARC provides visibility into authentication failures and enforces policies to block unauthorized senders.

How often should I audit delegated subdomains?

At least quarterly, or after any major project launch or team change to ensure access remains compliant.

Can role accounts cause issues in delegated subdomains?

Yes. Role accounts (e.g. support@) often generate spam complaints. Use email verification to filter them out.

What is the best way to test deliverability after revocation?

Use inbox placement tools and email-verification SaaS like MailTester to confirm no delivery issues persist.

Does MailTester detect catch-all addresses in bulk lists?

Yes. MailTester identifies catch-alls and risky addresses, helping you maintain list hygiene and reduce deliverability risk.

How do disposable domains affect subdomain reputation?

They increase bounce and complaint rates, which can harm the reputation of the entire domain, including delegated subdomains.

Can I integrate MailTester with Mailgun for real-time validation?

Yes. MailTester offers a real-time API that can be integrated into Mailgun's sending workflow for immediate address validation.