In Mailgun, open the new domain or subdomain and copy the exact SPF TXT value shown on its DNS records page.

In your DNS provider, create a TXT record on the exact subdomain host that Mailgun lists, not on the root and not on a www host.

Check that the subdomain has only one SPF TXT record.

Count the DNS lookups in the merged SPF record if you also send through other services from the same subdomain.

Wait for propagation, then click verify in Mailgun again.

Send a test message from the subdomain and check its authentication results in the received headers.