Mailgun 5xx "domain not verified" when the agent's outreach sends from an unverified sending domain
Completes Mailgun domain verification blocking recruiting outreach sends. Use it when Mailgun returns 5xx domain-not-verified. Key trigger: the domain was recently added or its DNS changed.
TL;DR: Finish the DNS records Mailgun asks for (SPF, DKIM, and tracking records), wait for Mailgun to verify them, and only then let the agent send. Mailgun refuses to send from domains it cannot verify, so there is no sending-side workaround.
Mailgun 5xx "domain not verified"- Open the domain in the Mailgun dashboard and list the DNS records it requires. Expected: a checklist showing which records are pending.
- Add each required record to the domain's DNS exactly as specified. Expected: DNS lookups return the expected values for every record.
- Wait for Mailgun's verification check to mark the domain verified (it polls DNS on its own schedule). Expected: the dashboard shows the domain as active/verified.
- Send a test message through the domain and check the Mailgun logs. Expected: the message is accepted and appears in the logs.
Use this when
- Mailgun sends fail with 5xx domain-not-verified errors.
- The sending domain was recently added to Mailgun.
- DNS for the domain changed (registrar move, DNS provider switch).
Not for this skill when
- The error is 401 (API key problem).
- The error is 5xx for a different reason (check the full message).
- You are on a sandbox domain (those restrict recipients instead).
Variant phrasings
- "Mailgun domain verification failed"
- "550 domain not verified Mailgun"
- "unverified sending domain Mailgun"
- "Mailgun domain pending DNS"
Why it happens
Mailgun requires proof of domain ownership and authentication before sending, enforced through DNS records. Partial setups (SPF added, DKIM skipped) or DNS changes after verification leave the domain in a pending state that blocks all sends.
Edge cases
- A subdomain must be verified separately from the parent domain.
- EU and US Mailgun regions use different API endpoints and dashboards; verify in the right one.
- DNS propagation delay means verification can take hours after records look right locally.
- The tracking CNAME is optional for sending but required if you want open/click tracking.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_5BTIu1svw73AiXD0TRYlDw