# Domain not verifying

> Find the DNS record that's holding verification back, and fix the most common mistakes.

Open the domain in **Email → Domains**. Each DNS record has its own status, so start with the records that are not `verified`.

## Check the record is published

Look the record up from a terminal, using the exact name from your dashboard:

```shell
dig +short CNAME <token>._domainkey.mail.example.com
dig +short MX nc-bounce.mail.example.com
dig +short TXT nc-bounce.mail.example.com
```

If a command prints nothing, the record is not visible yet. If it prints something different from the dashboard, fix the value.

## Common causes

### The domain name is doubled

Many providers append your root domain to every name. Entering `nc-bounce.mail.example.com` there creates `nc-bounce.mail.example.com.example.com`. Enter only `nc-bounce.mail`, then check with `dig` again.

### The records are at the wrong provider

Records only count at the provider your domain's nameservers point to. Run `dig +short NS example.com` and add the records at the provider shown — not at your registrar if your DNS is hosted elsewhere.

### Cloudflare is proxying the record

Proxied (orange cloud) CNAME records return Cloudflare's addresses instead of your value. Set each record to **DNS only**.

### The value was changed when pasting

Check for missing characters, extra spaces, or quotes added around values. DKIM values must match exactly. For TXT records, paste the value without surrounding quotes unless your provider requires them.

### The MX priority is missing

The bounce MX record needs priority `10`. Some providers have a separate priority field; others, like Route 53, expect `10 <mail server>` in the value.

### DNS hasn't propagated yet

Changes usually appear within minutes but can take up to 48 hours, depending on the previous record's TTL. Pending domains are re-checked automatically every 30 minutes, so verification completes on its own once records are visible.

## Record status reference

| Status | What to do |
| --- | --- |
| `not_started` | The record hasn't been checked yet. Select **Check status**. |
| `pending` | Not visible yet. Confirm it with `dig`, then wait for propagation. |
| `temporary_failure` | The check could not complete. It is retried automatically. |
| `failed` | The record was found but could not be verified. Compare its value with the dashboard. |
| `verified` | Nothing to do. |

DMARC is optional; its status never blocks sending.

## Still stuck?

Delete the record at your DNS provider, add it again by copying from the dashboard, and select **Check status**. If verification still fails, contact support with your domain name — never include API keys.

---

Source: https://connect.nxiom.com/docs/learn/domain-not-verifying