Domain verification keeps failing

Why this happens

Atender’s domain check delegates to Mailgun, which does a real DNS lookup for every record it generated for your domain. If even one record is missing or returns the wrong value, the domain status flips to Failed and stays there until you fix the DNS.

A few specific patterns account for the majority of failures.

1. A TXT record got truncated or wrapped

The TXT records Atender generates — particularly the DKIM key — are long. Some DNS provider UIs visually wrap the value but actually save it correctly; others wrap and truncate it, leaving a corrupted record in DNS.

Check for this: Use any free DNS lookup tool (dig, nslookup, or a web-based DNS lookup) to look up the TXT record at the exact host Atender specified. The value should be one long string with no spaces or line breaks. If you see something shorter than what Atender provided, your DNS provider truncated it.

Fix: Re-add the record. Some providers have a separate “long value” mode or accept the value if you paste without leading/trailing whitespace.

2. The MX records were added, but the TXT records were skipped

A common assumption is that the MX is the “important one” and the TXT records are optional. They are not. Without SPF and DKIM TXT records, mail you send will be rejected or junked by most recipients, and Atender will not flip the status to Active.

Fix: Open the domain row in Settings → Email and audit every record listed. Add the ones that are missing.

3. A typo in the hostname

DNS provider UIs often have a “Name” or “Host” field. Some providers auto-append the domain; others don’t. If you typed mail._domainkey.acme.com into a field that already appends .acme.com, you’ll end up with mail._domainkey.acme.com.acme.com — a real record at the wrong place.

Check for this: Look at what your DNS provider actually saved, not what you typed. The record’s fully-qualified name should match exactly what Atender listed.

Fix: Delete the doubled-up record and re-add it correctly for your provider’s convention. The trick is: if your provider auto-appends the domain, leave it off; if your provider does not, include it.

4. DNS hasn’t propagated yet

Changes to DNS take time to spread across the internet, anywhere from a few seconds to a few hours depending on your provider and TTL settings. If you click Check verification moments after saving, you may catch a stale lookup.

Fix: Wait 15–30 minutes and try Check verification again. If it still fails after a few hours, look at the records themselves with a DNS lookup tool — if your records aren’t visible to a third-party tool, Mailgun won’t see them either.

5. The wrong region was picked

The DNS records Atender generates are specific to the region (US or EU) you chose when adding the domain. If you have records from a previous setup mixed with records from a new one, verification can fail because the records in DNS point at the wrong infrastructure.

Fix: Delete the domain in Atender and the old records at your DNS provider, then add the domain fresh with the correct region.

When to ask for help

Ask support if:

• You’ve confirmed every record matches exactly what Atender listed.
• You’ve waited at least a few hours.
• Verification still fails with no clear hint in the row’s status message.

Include in your message: your domain, the region you chose, and the output of dig TXT yourdomain.com plus dig MX yourdomain.com so the team can see what DNS is actually returning.