> ## Documentation Index
> Fetch the complete documentation index at: https://docs.migma.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Verification Issues

> Troubleshoot and resolve domain verification issues

## Overview

Verifying a domain involves these steps:

1. Add your domain to Migma
2. Copy the DNS records from Migma
3. Add these records to your DNS provider
4. Click Verify in Migma

When completed correctly, your domain typically verifies within 15 minutes. If your domain isn't verifying, this guide will help you troubleshoot.

***

## Quick Checks

Before diving into detailed troubleshooting, verify these basics:

<Steps>
  <Step title="All Records Added">
    Confirm you've added all 8 DNS records:

    * 1 ownership TXT record
    * 3 DKIM CNAME records
    * 1 SPF TXT record on the sending domain
    * 1 DMARC TXT record
    * 1 MAIL FROM MX record
    * 1 MAIL FROM TXT record
  </Step>

  <Step title="Correct Location">
    Records must be added under the sending domain you added to Migma:

    * DKIM: `[token]._domainkey.[sending-domain]`
    * SPF: `[sending-domain]`
    * DMARC: `_dmarc.[sending-domain]`
    * MAIL FROM: `send.[sending-domain]`

    If the sending domain is `mail.yourdomain.com`, the MAIL FROM hostname is `send.mail.yourdomain.com`.
  </Step>

  <Step title="Values Match Exactly">
    Copy and paste values directly from Migma. Don't type them manually.
  </Step>

  <Step title="Wait for Propagation">
    DNS changes take 5-60 minutes typically. DKIM can take up to 72 hours in rare cases.
  </Step>
</Steps>

***

## Common Verification Issues

### DKIM Records Not Verifying

DKIM verification can take the longest. Here's what to check:

<AccordionGroup>
  <Accordion title="CNAME values have extra characters" icon="text-slash">
    **Problem:** Extra spaces, quotes, or trailing dots in the CNAME value.

    **How to check:**

    ```bash theme={null}
    dig CNAME [token]._domainkey.yourdomain.com
    ```

    **Solution:**

    * Delete the record
    * Copy the value directly from Migma
    * Paste without any modifications
    * Save the record
  </Accordion>

  <Accordion title="CNAME added as TXT record" icon="file-code">
    **Problem:** You accidentally created a TXT record instead of CNAME.

    **Solution:**

    * Delete the incorrect TXT record
    * Create a new CNAME record with the correct type
  </Accordion>

  <Accordion title="Proxy enabled (Cloudflare)" icon="cloud">
    **Problem:** Cloudflare proxy is enabled (orange cloud) for CNAME records.

    **Solution:**

    * Go to Cloudflare DNS settings
    * Find your DKIM CNAME records
    * Click the orange cloud to turn it gray (DNS only)

    Email authentication records cannot be proxied.
  </Accordion>

  <Accordion title="Still pending after 48 hours" icon="clock">
    **Problem:** DKIM verification hasn't completed after 48 hours.

    **Steps:**

    1. Verify the CNAME records are publicly visible:
       ```bash theme={null}
       dig CNAME [token]._domainkey.yourdomain.com
       ```
    2. If records aren't visible, check with your DNS provider
    3. Delete and re-add the domain in Migma
    4. Add fresh DNS records
  </Accordion>
</AccordionGroup>

### SPF Record Not Verifying

<AccordionGroup>
  <Accordion title="Multiple SPF records exist" icon="copy">
    **Problem:** You have more than one TXT record starting with `v=spf1`.

    **How to check:**

    ```bash theme={null}
    dig TXT yourdomain.com | grep spf
    ```

    If you see multiple `v=spf1` records, you have duplicates.

    **Solution:**

    * Keep only ONE SPF record
    * Combine all includes into a single record:
      ```
      v=spf1 include:_spf.google.com include:spf.migma.ai ~all
      ```
  </Accordion>

  <Accordion title="Include not added correctly" icon="code">
    **Problem:** `include:spf.migma.ai` is in the wrong position or has typos.

    **Correct format:**

    ```
    v=spf1 include:spf.migma.ai ~all
    ```

    **With existing includes:**

    ```
    v=spf1 include:_spf.google.com include:spf.migma.ai ~all
    ```

    **Common mistakes:**

    * `v=spf1 ~all include:spf.migma.ai` (include must be before \~all)
    * `v=spf1 include:spf.migma.ai` (missing \~all or -all at end)
    * `v=spf1 include: spf.migma.ai ~all` (extra space)
  </Accordion>

  <Accordion title="SPF added to wrong domain" icon="sitemap">
    **Problem:** SPF record added to a different domain than the sending domain.

    **Check:** SPF for sending authorization should be on the exact sending domain you added in Migma. If you added `mail.yourdomain.com`, the SPF record belongs on `mail.yourdomain.com`, not `yourdomain.com`.

    **Note:** You also need a separate SPF record on `send.[sending-domain]` for MAIL FROM.
  </Accordion>
</AccordionGroup>

### MAIL FROM Not Verifying

<AccordionGroup>
  <Accordion title="MX record missing or incorrect" icon="envelope">
    **Problem:** The MX record for `send.[sending-domain]` is missing or has wrong value.

    **How to check:**

    ```bash theme={null}
    dig MX send.mail.yourdomain.com
    ```

    **Solution:**

    * Add the MX record with priority 10
    * Copy the value exactly from Migma
    * Ensure the subdomain is `send`, not `mail`
  </Accordion>

  <Accordion title="TXT record for send subdomain missing" icon="file-lines">
    **Problem:** The SPF TXT record for `send.[sending-domain]` is missing.

    **How to check:**

    ```bash theme={null}
    dig TXT send.mail.yourdomain.com
    ```

    **Solution:** Add a TXT record:

    * Name: copy the MAIL FROM name from Migma, often `send` under the sending domain
    * Value: `v=spf1 include:spf.migma.ai ~all`
  </Accordion>

  <Accordion title="MX priority conflict" icon="list-ol">
    **Problem:** Another service already uses priority 10 on `send.[sending-domain]`.

    **Solution:** Use a different priority number (e.g., 5 or 20).

    See [MX Record Conflicts](/sending-domains/mx-record-conflicts) for details.
  </Accordion>
</AccordionGroup>

### DMARC Not Verifying

<AccordionGroup>
  <Accordion title="Record name is wrong" icon="at">
    **Problem:** DMARC record created with incorrect name.

    **Correct:** `_dmarc.yourdomain.com`

    **Common mistakes:**

    * `dmarc.yourdomain.com` (missing underscore)
    * `_dmarc` without domain (depends on DNS provider)

    **Solution:** Create a TXT record with name `_dmarc` (some providers append the domain automatically).
  </Accordion>

  <Accordion title="Invalid DMARC syntax" icon="code">
    **Problem:** DMARC value has syntax errors.

    **Correct format:**

    ```
    v=DMARC1; p=quarantine; rua=mailto:dmarc@migma.ai
    ```

    **Common mistakes:**

    * Extra spaces or missing semicolons
    * Wrong policy value (should be `quarantine` or `reject`)
    * Typo in `DMARC1`
  </Accordion>
</AccordionGroup>

***

## DNS Provider Issues

### Auto-Appending Domain Names

Some DNS providers automatically append your domain to record values.

**Problem:** Your MX record becomes:

```
feedback-smtp.us-east-1.amazonses.com.yourdomain.com
```

Instead of:

```
feedback-smtp.us-east-1.amazonses.com
```

**Solution:** Add a trailing period (dot) at the end:

```
feedback-smtp.us-east-1.amazonses.com.
```

### Records in Wrong DNS Provider

If your domain uses multiple DNS services (registrar, Cloudflare, Vercel, etc.), you might be adding records to the wrong one.

**How to check:**

```bash theme={null}
dig NS yourdomain.com
```

This shows which nameservers control your domain. Add Migma's DNS records at that provider.

***

## Checking Your DNS Records

### Using Web Tools

* [DNS Checker](https://dnschecker.org) - Check propagation globally
* [MXToolbox](https://mxtoolbox.com/SuperTool.aspx) - Detailed DNS lookups
* [DKIM Validator](https://dmarcian.com/dkim-inspector/) - Verify DKIM specifically

### Using Terminal Commands

**Check DKIM CNAME records:**

```bash theme={null}
dig CNAME [token]._domainkey.[sending-domain]
```

**Check SPF record:**

```bash theme={null}
dig TXT [sending-domain] | grep spf
```

**Check DMARC record:**

```bash theme={null}
dig TXT _dmarc.[sending-domain]
```

**Check MAIL FROM MX:**

```bash theme={null}
dig MX send.[sending-domain]
```

**Check MAIL FROM SPF:**

```bash theme={null}
dig TXT send.[sending-domain]
```

***

## DNS Propagation Times

| Record Type      | Typical Time  | Maximum Time |
| ---------------- | ------------- | ------------ |
| TXT (SPF, DMARC) | 5-15 minutes  | 24 hours     |
| CNAME (DKIM)     | 15-60 minutes | 72 hours     |
| MX (MAIL FROM)   | 5-15 minutes  | 24 hours     |

If records aren't visible after the maximum time, the issue is with your DNS configuration, not propagation.

***

## Still Not Working?

If you've tried everything above and your domain still won't verify:

<Steps>
  <Step title="Delete and Re-add">
    In Migma, delete the domain and add it fresh. This generates new DNS records.
  </Step>

  <Step title="Screenshot Your DNS">
    Take screenshots of all DNS records you've added.
  </Step>

  <Step title="Contact Support">
    Reach out with:

    * Your domain name
    * Screenshots of your DNS configuration
    * Output from the `dig` commands above
  </Step>
</Steps>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="MX Record Conflicts" icon="arrows-split-up-and-left" href="/sending-domains/mx-record-conflicts">
    Understand MX record conflicts
  </Card>

  <Card title="Cloudflare Setup" icon="cloud" href="/sending-domains/cloudflare">
    One-click DNS with Cloudflare
  </Card>
</CardGroup>