# DNS verification failed

> What a failed SPF, DKIM, DMARC or MX check means, why we query public resolvers, and how to fix BYO domains.

Source: https://emailpal.io/help/dns-verification-failed

## What failed

Open the domain → DNS. Each record shows expected vs observed. **Observed** is what public resolvers returned, not what our nameserver thinks.

Common BYO failures:

- Nameservers not switched, or switched but not propagated
- Old SPF still present, or too many includes (10-lookup limit)
- DKIM hostnames copied with the domain twice (`rsa._domainkey.example.com.example.com`)
- DMARC TXT missing at `_dmarc`
- MX still pointing at Google/Microsoft while we expect EmailPal

Click recheck after you save at the DNS host. Propagation can take minutes to hours, not usually days.

## FAQs

### It is green for me in a lookup tool and red here.

Different resolvers, caching, or you queried our nameserver directly. We deliberately do not grade ourselves.

### Registered through EmailPal and still red.

That is a provision/DNS job issue — [open a ticket](/support/new) with the domain and screenshot of expected vs observed.

## Need More Help?

[SPF, DKIM, DMARC and MX](/help/spf-dkim-dmarc-and-mx).