DNS and authentication
DNS verification failed
What a failed SPF, DKIM, DMARC or MX check means, why we query public resolvers, and how to fix BYO domains.
What failed
Open the domain → DNS. Each record shows expected vs observed. Observed is what public resolvers returned, not what our nameserver thinks.
Common BYO failures:
- Nameservers not switched, or switched but not propagated
- Old SPF still present, or too many includes (10-lookup limit)
- DKIM hostnames copied with the domain twice (
rsa._domainkey.example.com.example.com) - DMARC TXT missing at
_dmarc - MX still pointing at Google/Microsoft while we expect EmailPal
Click recheck after you save at the DNS host. Propagation can take minutes to hours, not usually days.
FAQs
It is green for me in a lookup tool and red here.
Different resolvers, caching, or you queried our nameserver directly. We deliberately do not grade ourselves.
Registered through EmailPal and still red.
That is a provision/DNS job issue — open a ticket with the domain and screenshot of expected vs observed.