What if my domain is not verifying?

DKIM and return-path records must match exactly.

Usually one DNS record is missing, on the wrong host, or the wrong type. Compare each record on the domain page with what your DNS provider publishes, fix the one that differs, then click Check DNS.

What has to verify before you can send

Setup Needs to verify
Default (PostShiba DKIM key) The DKIM CNAME and the return-path CNAME.
Imported DKIM key (dkim_manual) The DKIM TXT record. Return-path can come later. Until rp. verifies, bounces use our return-path.

DMARC is optional and never blocks sending.

Check the records

Record Host What we check
DKIM CNAME ps1._domainkey.example.com A CNAME to the DKIM target shown on the domain page.
DKIM TXT ps1._domainkey.example.com With an imported key, a TXT whose value matches the public key shown on the domain page.
Return-path CNAME rp.example.com A CNAME to the return-path target shown on the domain page.
DMARC TXT _dmarc.example.com Optional. If it is missing here and on the parent domain, the domain shows DMARC as not set. Sending still works.

ps1 is the default DKIM selector. If you imported a key with another selector, use that selector instead.

A record can point through a zone you control first, such as rp.example.com → rp.yourzone.com → our target. We follow up to 8 CNAME hops. With an imported key, the DKIM host can also be a CNAME to a TXT in your zone.

Fix and recheck

  1. Open Domains & Tenants and select the domain.
  2. Compare each record with your DNS provider. Fix the host, the type, or the value.
  3. Wait for your DNS provider to publish the change.
  4. Click Check DNS. With the API, call POST /api/v1/sending_domains/:sending_domain_id/verify.

If a check misses, we check again after 30 seconds, 2 minutes, and 5 minutes. A send from a domain that has not verified also triggers a fresh check first.

Common mistakes

  • The wrong record type. A TXT where we asked for a CNAME, or the reverse.
  • The wrong host. DKIM goes on ps1._domainkey.example.com, not on example.com. Return-path goes on rp.example.com.
  • A dropped subdomain. For mail.example.com, the return-path host is rp.mail.example.com, not rp.example.com. Many DNS providers want the name relative to the zone, so you type rp.mail.
  • Swapped values. The DKIM target belongs on the _domainkey host. The return-path target belongs on rp..
  • An old DKIM record left in place. Importing or refreshing a key resets DKIM until the new record is published.
  • MX on the sending domain. Receiving uses its own host, inbound.example.com by default. See How do I avoid MX conflicts?.

Check DNS also looks for the value on common wrong hosts and types. When it finds one, the domain page tells you which record to move.

Next steps