DNS Authentication Troubleshooting
Required DNS Records
| Record | Type | Name | Purpose |
|---|---|---|---|
| SPF | TXT | yourdomain.com |
Authorizes which servers can send email for your domain |
| DKIM | TXT | selector._domainkey.yourdomain.com |
Cryptographically signs emails to prove authenticity |
| DMARC | TXT | _dmarc.yourdomain.com |
Tells receivers how to handle emails that fail SPF/DKIM |
| Tracking Domain | A | tracking.yourdomain.com |
Routes tracking links (opens, clicks) through your domain |
| Webhook Domain | A | webhook.yourdomain.com |
(Optional) Routes webhook callbacks through your domain |
| MX | MX | yourdomain.com |
(Optional) Processes unsubscribes from ReplyTo emails |
Validation Statuses
| Status | Meaning | Action |
|---|---|---|
| Success | Record is correctly configured and verified | No action needed |
| Failed | Record is missing, incorrect, or not matching | Check DNS and fix |
| Pending | Validation has been queued | Wait for processing |
| InProgress | Validation is currently running | Wait for completion |
| Undefined | Not yet checked | Click Verify to start |
SPF Troubleshooting
| Issue | Fix |
|---|---|
| Multiple SPF records | DNS allows only one SPF TXT record per domain. Merge all include: directives into a single record. |
| Too many DNS lookups | SPF has a 10-lookup limit. Use ip4: or ip6: for direct IPs instead of include: where possible. |
| Record not found | Add the SPF TXT record to your domain's DNS zone. Use the exact value from EmailElement. |
| "softfail" or "fail" results | Ensure the sending IP/domain is included in your SPF record. |
DKIM Troubleshooting
| Issue | Fix |
|---|---|
| Selector mismatch | The DKIM selector in DNS must match the selector configured in EmailElement (Sender Domains > DKIM Selector field). |
| Public key not showing | Save the Sender Domain first — the DKIM public key is generated on save. |
| Key too long for single TXT record | Some DNS providers require splitting long TXT values into multiple strings. Check with your DNS provider. |
| External ESP DKIM | If using an external ESP, the ESP may use its own DKIM selector. Configure the ESP's DKIM records in addition to EmailElement's. |
DMARC Troubleshooting
| Issue | Fix |
|---|---|
| No DMARC record | Add a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| DMARC alignment failure | DMARC requires the domain in the From: header to align with SPF or DKIM. Fix SPF and DKIM first. |
| Policy too strict too soon | Start with p=none (monitoring only), review reports, then move to p=quarantine, then p=reject. |
Tracking Domain Troubleshooting
| Issue | Fix |
|---|---|
| Tracking SSL Failed | The A record must point to the correct IP shown in EmailElement. SSL provisioning happens automatically after the A record is verified. |
| Links not tracking | Verify the tracking domain A record is correct and SSL status shows Success. |
Verification Steps
- Make DNS changes at your domain registrar or DNS provider
- Wait for propagation (can take up to 48 hours, usually 15-60 minutes)
- Navigate to Sender Domains > click the domain
- Click Verify to re-run validation
- All statuses should show Success (green)