Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Amazon SES Easy DKIM verification fails despite valid CNAME records

3

Amazon SES Easy DKIM verification is failing in US East (Ohio), us-east-2. SES generated three Easy DKIM CNAME records. All three records are published in the authoritative DNS and have been independently verified through MXToolbox as resolving from the SiteGround authoritative nameservers to the exact dkim.amazonses.com targets shown by SES.

SiteGround support has also confirmed that all three CNAME records are publicly resolving correctly. However, SES failed verification after the 72-hour verification period and the domain identity now shows Error, with DKIM configuration showing “Not configured.”

We have retried verification without changing the DNS records. Why is SES in us-east-2 unable to detect these publicly resolvable Easy DKIM CNAME records, and what should we do to get the domain verified without regenerating the DKIM records?

Topics
Front-End Web & MobileBusiness Applications
Tags
Amazon Simple Email Service
Language
English

asked a month ago85 views

2 Answers
1

It is frustrating that SES can spend 72 hours failing to recognize valid DKIM records, while this public video appears to show a questionable Production Access request being approved within seconds: https://www.youtube.com/watch?v=Gr9uPlMqo-M Automation should help legitimate customers with correctly configured domains, not create such a difficult contrast.

answered a month ago

0

Amazon SES Easy DKIM verification can fail even when CNAME records resolve correctly if the record names are entered incorrectly, if DKIM is not enabled for the identity in the correct region/account, or if SES cannot see the authoritative NS records. This is the most common cause of “Not configured” errors after 72 hours.

https://docs.aws.amazon.com/ses/latest/dg/troubleshoot-dkim.html

EXPERT

answered a month ago

  • Seasoned Handyman
    a month ago

    Thank you for the response. We have already checked each of those items.

    This SES identity is in us-east-2 (US East/Ohio), and DKIM signatures are enabled for that identity. We also verified all three SES-generated Easy DKIM CNAME records individually.

    Each CNAME was queried publicly through MXToolbox, and the results came directly from the authoritative SiteGround nameservers (ns1.siteground.net / ns2.siteground.net). All three returned the exact dkim.amazonses.com targets currently displayed by SES. SiteGround support independently confirmed the same.

    Despite that, SES failed verification after 72 hours and now reports the domain identity as Error with DKIM configuration “Not configured.”

    Since the record names, CNAME targets, authoritative nameservers, region, and DKIM setting have already been verified, what would you recommend checking next on the SES side? Is there a way to determine exactly what DNS response SES is receiving for these selectors or why SES is not detecting records that resolve correctly from the authoritative nameservers?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content