Amazon SES DKIM verification pending or failed: how to fix it

What it means

When you add a domain to Amazon SES with Easy DKIM, SES gives you three CNAME records. SES looks for them in your public DNS. Until it finds all three, the domain identity is not verified and SES does not sign your email with DKIM (DomainKeys Identified Mail, a digital signature that proves the message comes from your domain). The DKIM status can be:

• PENDING: SES has not found the records yet.
• SUCCESS: the records were found; signing is active.
• FAILED: SES gave up, usually because it did not find the records.
• TEMPORARY_FAILURE: a temporary DNS problem prevents SES from checking.
• NOT_STARTED: verification was never started.

SES searches for the records for up to 72 hours. After that, a domain still not found switches to Failed.

Why it happens

• Doubled domain name. Many DNS panels add your domain automatically. If you paste abc123._domainkey.yourdomain.com as the name, the real record becomes abc123._domainkey.yourdomain.com.yourdomain.com. See DNS record added at the wrong name.
• Records created as TXT instead of CNAME, or with the value truncated, or with a missing .dkim.amazonses.com ending.
• Only one or two of the three records were added.
• Proxy enabled. On Cloudflare, a proxied (orange cloud) CNAME is not returned as a CNAME; see Cloudflare proxied records break email.
• Wrong DNS zone. You edited the zone at your registrar, but the domain uses other name servers (your host, Cloudflare, Route 53...).
• Another Region or account. DKIM is configured per Region and per AWS account. Records created for one Region do not verify the identity in another one, unless you use the feature that replicates keys across Regions.

How to check

In the SES console, open Identities, choose your domain and look at the DKIM section: it lists the three exact records. They look like this (tokens are unique to you):

Name:  abc123token1._domainkey.yourdomain.com
Type:  CNAME
Value: abc123token1.dkim.amazonses.com

Query each name from a terminal. A correct answer returns the dkim.amazonses.com target:

dig +short CNAME abc123token1._domainkey.yourdomain.com
abc123token1.dkim.amazonses.com.

dig +short NS yourdomain.com

The second command shows which name servers really host your zone. You can also run the Delivmail domain scanner on your domain to see the DNS records the world sees. From the CLI, aws sesv2 get-email-identity --email-identity yourdomain.com shows DkimAttributes.Status and the expected tokens.

How to fix it

1. Copy the three records exactly. Use the copy buttons or Download .csv record set. If your panel adds the domain itself, enter only abc123token1._domainkey as the name.
2. Use type CNAME and, on Cloudflare, set the records to DNS only.
3. Edit the right zone: the one served by the name servers returned by dig NS.
4. If the domain is on Route 53 in the same AWS account, SES can publish the records for you.
5. Wait. Most providers publish within minutes, but SES may need up to 72 hours to notice. Lowering the TTL does not speed up the first check of a brand new record. See DNS propagation and TTL.
6. If the status is Failed, fix the records first, then restart verification. AWS recommends retrying from the console once the records resolve; a commonly used method is to disable and re-enable DKIM signing for the identity, or delete and recreate the identity (this creates new tokens, so you must publish the new records).

If you use BYODKIM (your own key) instead of Easy DKIM, SES looks for a TXT record at selector._domainkey.yourdomain.com. The private key must be RSA 1024 or 2048 bits, base64 encoded, and the public key in DNS must have no header, footer or line breaks.

Once DKIM works, think about the bounce address too: by default SES uses an amazonses.com MAIL FROM domain, so SPF does not align with your domain. See custom MAIL FROM domain for DMARC alignment.

Check that it is fixed

The console should show the identity as Verified and DKIM as Successful. Then send a message through SES to your unique address on the Delivmail home page. The report should show a valid DKIM signature with d=yourdomain.com. You will also see a second signature with d=amazonses.com; SES adds it on purpose and it is harmless. If you get an email from SES saying your DKIM setup will be revoked, it means the records were removed: put them back before the deadline in that email.