Domain Verification Stuck on Pending: Why DNS Records Are Not Found

Verification checks are blunt: the checker looks up a name, compares what comes back with what it expects, and reports missing on any difference. "Pending" after you have pasted every record means the live DNS does not yet contain exactly those records at exactly those names. The record is in the wrong place, slightly different from what was shown, or not published yet. Here is how to find which, record by record, without waiting 48 hours to find out.

Quick answer

Query each record directly at a public resolver (dig @8.8.8.8 TXT _dmarc.yourdomain.com, and the same for the SPF root record, the DKIM selector name and the MX). Whatever comes back is what the verifier sees. If a record is absent, it is not in the live zone: check the nameservers, the host column, and the record type. If it is present but different, fix the value. If it is present and identical, click Verify again; the checker reads live DNS.

Check the right things, in order

1. Nameservers. Look up NS for the domain. If they belong to Cloudflare, a web host or a previous provider, the records must be added there, not at the registrar's panel. This is the cause in about half of all stuck verifications.
2. Host column. Open the record list and read the names. A row showing yourdomain.com.yourdomain.com or selector._domainkey.yourdomain.com.yourdomain.com means the domain was typed into a field that wanted only the prefix. Delete and re-add with the host blank (or @) for the root, _dmarc for DMARC, and the selector name only for DKIM.
3. Record type. SPF, DKIM and DMARC are TXT records. The MX is an MX records (the settings that tell the internet where to deliver email for your domain). A value in the wrong type is invisible to the checker.
4. Value. No surrounding quotes unless the panel adds them for you, no line breaks, no trailing spaces, and the DKIM key pasted whole. A dashboard copy button avoids most of this.
5. Only one SPF record. Two TXT records beginning v=spf1 make SPF invalid and most verifiers report it missing. Merge them.
6. propagation (the short wait while DNS changes spread across the internet). If the direct query shows the right record but the verifier does not, a resolver between them still holds the old answer. Wait for the TTL (shown in the query output, often 300 to 3600 seconds) and retry.

DKIM is the usual holdout

The DKIM record has the longest value and the most specific name, so it fails most often. The host must be the selector followed by ._domainkey, with the domain added by the panel. Some panels reject values over 255 characters and need the key split into quoted chunks; see TXT record too long. Query the full name (selector._domainkey.yourdomain.com) and compare the p= value with the dashboard, character for character.

Less common causes

• DNSSEC enabled at the registrar but not at the DNS host (or the other way around) after a nameserver change. Resolvers return SERVFAIL for the whole domain and every record looks missing. Disable DNSSEC at the registrar until the DNS host supports it.
• A brand-new domain whose nameservers the registry has not yet published. Everything is correct and simply needs an hour.
• Domain status clientHold or serverHold (unverified registrant email, unpaid renewal). The registry does not publish the domain at all. Check the registrar account for a warning banner.
• Records added to a staging or duplicate zone. Some hosts let you create a second zone for the same domain; only the one bound to the live nameservers counts.

Confirm before you click Verify

Run the domain through the free MX lookup, SPF checker and DMARC checker. They query public resolvers directly and show the raw record, so a mismatch is visible instead of hidden behind "pending". When all three show the expected values, Verify will pass.

Common questions

Do I need to wait 48 hours?

No. That figure is the worst case for a nameserver change. Record changes at an existing DNS host are visible within minutes to an hour. If it has been longer, something is wrong, not slow.

The registrar says the record was added successfully.

The panel saved it; that does not mean the nameservers serving your domain publish it. Check the NS records first.

Can I verify with only the MX record?

Receiving works with MX alone, but sending needs SPF and DKIM to pass, and DMARC to stop impersonation. Finish all four; it is one visit to the panel.

Want to see how your own domain is set up? Use the free SPF checker, DMARC checker and MX lookup: they run in your browser and store nothing.