DNS Troubleshooting for Sender Domains

"Not Verified" Diagnostic Steps

1. Check propagation time: DNS changes can take up to 48 hours to propagate globally, though most propagate within 15 minutes. Re-validate after waiting.
2. Verify the record exists: Use diagnostic tools (see below) to confirm the record is published.
3. Check for typos: Compare the record value character-by-character against what EmailElement displays.
4. Confirm record type: Ensure you created the correct record type (TXT, CNAME, or MX) as specified.
5. Check the host/name field: Some providers require the full domain (e.g., _dmarc.yourdomain.com), others require just the subdomain (e.g., _dmarc).

Diagnostic Tools

Useful dig Commands

# Check SPF record
dig TXT yourdomain.com +short

# Check DKIM record
dig TXT selector._domainkey.yourdomain.com +short

# Check DMARC record
dig TXT _dmarc.yourdomain.com +short

# Check MX record
dig MX yourdomain.com +short

# Query a specific nameserver (bypass cache)
dig TXT yourdomain.com @8.8.8.8 +short

Common Mistakes

Duplicate SPF Records

• Problem: Two or more TXT records starting with v=spf1 on the same domain.
• Result: SPF PermError; all SPF checks fail.
• Fix: Merge all SPF mechanisms into a single record. Example: combine v=spf1 include:_spf.google.com -all and v=spf1 include:spf.emailelement.com -all into v=spf1 include:_spf.google.com include:spf.emailelement.com -all.

Exceeding 10 DNS Lookups

• Problem: SPF record includes too many include:, a, mx, or redirect mechanisms.
• Result: SPF PermError after the 10th lookup.
• Fix: Remove unnecessary mechanisms, use ip4: for static IPs (these do not count as lookups), or use an SPF flattening service.

Wrong DKIM Selector

• Problem: DKIM CNAME record uses the wrong selector name.
• Result: DKIM verification fails because the public key cannot be found.
• Fix: Copy the exact selector from the EmailElement Sender Domain settings page. It is case-sensitive.

CNAME at Root Domain

• Problem: Trying to set a CNAME record on the root domain (e.g., yourdomain.com instead of subdomain.yourdomain.com).
• Result: DNS conflict; CNAME cannot coexist with other record types at the same host.
• Fix: Use TXT records for SPF and DMARC at the root. DKIM CNAME goes on a subdomain (selector._domainkey.yourdomain.com).

Missing Trailing Period

• Problem: Some DNS providers require a trailing period on fully qualified domain names (e.g., spf.emailelement.com.).
• Result: Record resolves incorrectly.
• Fix: Check your provider's documentation. Most modern providers handle this automatically.

Provider-Specific Notes

Cloudflare

• Proxy status: DNS records used for email (MX, TXT for SPF/DKIM/DMARC) must have the proxy disabled (grey cloud, "DNS only"). Orange cloud (proxied) will break email authentication.
• CNAME flattening: Cloudflare flattens CNAME records at the root by default. This is fine for most cases but can affect DKIM if the CNAME target changes.
• TTL: Set to "Auto" for most records. For initial setup, a lower TTL (1 minute) speeds up propagation testing.

GoDaddy

• TXT record length: GoDaddy has a 1024-character limit on TXT record values. Long DKIM keys may need to be split across multiple strings (GoDaddy usually handles this automatically).
• Host field: Use @ for root domain records. Use just the subdomain portion for subdomains (e.g., _dmarc not _dmarc.yourdomain.com).
• Propagation: GoDaddy DNS typically propagates within 30 minutes but can take up to 48 hours.

Namecheap

• Host field: Use @ for root domain. Use subdomain only (e.g., _dmarc) for subdomains.
• TXT records: Wrap values in quotes if the control panel does not do so automatically.

AWS Route 53

• TXT records: Values must be enclosed in double quotes in the record value field (e.g., "v=spf1 include:spf.emailelement.com -all").
• Propagation: Usually very fast (under 60 seconds) within AWS, but external propagation follows normal timelines.
• Alias records: Do not use Route 53 Alias records for email DNS. Use standard record types.

Google Domains / Squarespace

• Host field: Leave blank or use @ for root domain records.
• TXT records: No quoting needed; the interface handles formatting.
• DKIM: Enter the full selector (e.g., ee1._domainkey) in the host field.

When to Escalate

• SPF, DKIM, and DMARC are all correctly configured but EmailElement still shows "Not Verified" after 48 hours.
• DNS provider does not support the required record type.
• Domain is behind a registrar lock or transfer hold that prevents DNS changes.
• DNSSEC is enabled and causing validation failures.