Domain not verifying
A checklist for DNS records that stay pending or failed.
After you publish the records, usend checks them with public DNS resolvers and keeps re-checking. A new domain has 24 hours from its first verification before it becomes failed; you can restart the window with Retry verification. Each record on the domain's page has its own status, so start with the one that is not verified. Background: Verify a domain.
Quick checks from a terminal
Replace acme.com and the selector with what usend shows:
dig +short TXT rs1._domainkey.acme.com
dig +short CNAME send-ses.acme.com
dig +short TXT _dmarc.acme.comAn empty answer means the record is not published at that exact name. You can also look at what public resolvers see on a site such as dnschecker.org.
Most common causes
| Symptom | Cause and fix |
|---|---|
Name looks like rs1._domainkey.acme.com.acme.com | Your DNS host appends the domain for you and you typed the full name. Enter only rs1._domainkey. |
| The name looks right but nothing shows up | Your domain's DNS is not hosted where you edited. Check the nameservers of the domain: records only count at the provider that runs them. |
| Just published | DNS caches "not found" answers for a while. Wait up to an hour, then press Verify again. |
DKIM pending or failed | The value is cut off, has extra spaces or quotes, or was retyped. Paste it again: DKIM keys. |
Return-path CNAME failed and DNS shows a value | The CNAME points somewhere else, or it is proxied. On Cloudflare set it to DNS only (grey cloud). |
| The CNAME will not save | Another record already exists at that name (a CNAME cannot share a name with other records). Remove the old record, or choose another label: Custom return path. |
Domain was verified, then pending or failed | Records were deleted or changed. A verified domain stays verified for 72 hours while usend retries, then stops sending. Restore the records. |
failed right away | Another organization on usend already verified this domain. Contact [email protected] if the domain is yours. |
DMARC shows pending | DMARC is not required to verify. It only needs a TXT at _dmarc that starts with v=DMARC1. |
A CNAME and your root records
The return-path CNAME is on a subdomain (send or send-ses), so it never conflicts with the root. Do not add a CNAME on the root itself.
When it says verified but sending fails
- The From address must be on the verified domain or a subdomain of it.
- Your organization may be in the sandbox: see Production approval.
- A domain restricted API key can only send from its own domain: API keys.
Still failing?
Use Auto-configure if you are on Cloudflare (guide), or download the .zone file (or the .csv) from the domain's page and import it. Otherwise write to [email protected] with the domain name and a screenshot of your DNS records list.