Blog

Amazon SES DKIM verification failed: how to fix it

Reviewed by the Free Domain Mail editorial team · Updated September 20, 2026

Amazon SES reports a DKIM setup failure when it cannot find the DNS records issued for a domain identity. SES normally waits up to 72 hours before changing a pending verification to failed. The failure applies to the AWS Region named in the notice, so a verified identity in another Region does not resolve it.

What the failure means

Easy DKIM gives each SES identity three CNAME records. SES queries public DNS for those exact names and targets. A failure means the expected answers were not visible before the verification window ended. It does not prove that the website, incoming mailbox or every DNS record for the domain is broken.

A notice for Asia Pacific (Singapore) refers to ap-southeast-1. Check the identity and DNS values in that Region. SES creates separate DKIM configuration for each Region unless you deliberately use an AWS feature that replicates DKIM configuration.

Before changing DNS

Only troubleshoot a domain that you own or are authorized to administer. Sign in to the authoritative DNS provider, which may differ from the registrar. Record the current CNAME, TXT and MX values before editing anything.

Do not copy the selector or target from this guide, another Free Domain Mail customer or another SES Region. The examples below use freedomainmail.com only to explain the field layout. The application displays the real values generated for the connected domain.

Open the DKIM records in Free Domain Mail

Sign in to Free Domain Mail, open Manage, and choose Domains. Select the connected domain. The setup card has five stages: ownership, receiving, SPF, DKIM and DMARC. Open Authenticate sending, labeled DKIM, to see the records assigned to that domain.

For freedomainmail.com, a Name or Host follows the pattern selector._domainkey.freedomainmail.com. The Value or Target points to an AWS DKIM hostname. Free Domain Mail shows a shortened relative host for DNS panels that append the domain automatically. Use the Copy buttons beside Name and Value so no character is lost.

Publish each Easy DKIM CNAME correctly

At the authoritative DNS provider, create every CNAME shown in the DKIM stage. Put the relative selector in Name or Host when the provider automatically appends freedomainmail.com. Put the complete AWS hostname in Value, Target or Points to. DKIM records do not use MX priority.

If Cloudflare hosts the DNS zone, keep these CNAME records as DNS only. Do not enable the orange HTTP proxy. Leave unrelated website records, MX records and verification TXT records unchanged. Some DNS editors reject a fully qualified host because they append the zone automatically; in that case, use only the selector._domainkey portion shown by Free Domain Mail.

Check the public DNS answer

Return to the domain card after saving every record. Continue to the last step and choose Check and complete. Free Domain Mail checks the public answers and marks each record when it matches. If a record remains unverified, compare its type, relative host and target character by character.

You can also open the public DKIM Checker and enter freedomainmail.com with the selector from the Name field. A selector is the label before ._domainkey. A successful lookup proves that the public CNAME resolves; it does not prove that a different domain or Region is configured correctly.

Diagnose a record that is still missing

First query the domain's public NS records and confirm that you edited that provider. Next check for a duplicated name such as selector._domainkey.freedomainmail.com.freedomainmail.com, a missing underscore, an incomplete target, or a CNAME placed under the wrong DNS zone.

DNS caches may retain an older answer until the previous TTL expires. AWS advises allowing up to 72 hours in rare cases. Waiting will not fix a misspelled record, the wrong authoritative provider or values copied from another SES Region, so verify those items before restarting the setup.

Retry safely after SES reports Failed

Once all expected CNAME answers are publicly visible, use the retry or DKIM setup action for the same identity in the same SES Region. In Free Domain Mail, run Check and complete again so the application refreshes the domain status. Do not delete working MX, SPF or DMARC records while repairing DKIM.

If the notice names a domain you do not control, stop. Remove or report the unauthorized connection through the appropriate account support path instead of trying to publish DNS. A user cannot verify DKIM without control of the domain's authoritative DNS.

Confirm the repair on a real message

After the domain is ready, send a normal low-volume test message to an external mailbox. Inspect the received message's Authentication-Results and DKIM-Signature headers. The signing domain should align with the visible From domain when DKIM is used for DMARC alignment.

A green DNS status confirms configuration, not inbox placement. Delivery still depends on sender reputation, recipient expectations, bounce and complaint behavior, content and provider policy. Keep the DKIM CNAME records in DNS while SES uses that identity.

Common mistakes to avoid

Editing DNS at the registrar when different nameservers are authoritative.
Copying DKIM selectors from another domain, AWS account or Region.
Entering the full domain where the DNS provider appends it automatically.
Proxying DKIM CNAME records through Cloudflare.
Publishing only one of the Easy DKIM CNAME records shown by SES.
Deleting MX, SPF or DMARC records while trying to repair DKIM.
Assuming that waiting will correct a misspelled hostname or target.

Frequently asked questions

Why did Amazon SES wait three days before reporting failure?

AWS says DNS changes can take up to 72 hours to become visible in rare cases. SES changes the status when it still cannot find the required records after that verification period.

Can I reuse the freedomainmail.com DKIM records for my domain?

No. The domain in this guide is only a field-format example. Copy the records shown for your own connected domain inside Free Domain Mail.

Why is DKIM verified in one AWS Region but failed in Singapore?

SES identities and Easy DKIM settings are Region-specific unless a supported replication design is configured. Verify the identity and publish the records generated for ap-southeast-1.

Should I delete and reconnect the domain?

Usually no. First correct the public DNS records and retry verification for the existing identity. Deleting an identity can disrupt a working configuration and does not fix DNS entered at the wrong provider.

Does DKIM verification guarantee that email reaches the inbox?

No. DKIM authenticates a signed message. Reputation, complaints, recipient behavior, content and other provider signals still affect delivery.