Troubleshoot Unverified DNS Checker for Custom Domain Email in Atlassian Cloud
Platform Notice: Cloud Only - This article only applies to Atlassian apps on the cloud platform.
Summary
A custom-domain email DNS checker shows UNVERIFIED when the published DNS records don't exactly match the values Atlassian expects — most often the SPF record when multiple SPF entries exist.
Diagnosis
Go to admin.atlassian.com and access your organization configuration.
Then, go to Settings > Email > Email Domains.
For Status, it still shows UNVERIFIED.
Cause
In order to verify successfully, all the DNS record values must be exact as in the DNS records in the configuration. As for SPF configuration, if it has multiple entries, the value must be valid.
Solution
To verify txt for SPF records
Default SPF include value:
include:_spf.atlassian.net.Verify the TXT/SPF record with:
dig -t txt domain.comand look for thev=spf1record.Look for v=spf1 record. If multiple SPF records exist, merge them into one (multiple SPF records cause a PermError).
You may also verify the SPF record from SPF Lookup from MXToolbox page.
To verify the CNAME record for DKIM Active, DKIM Fallback, and the bounce record
Copy the CNAME DKIM Active name, for example:
atlassian-8d2d08._domainkey.test.orgThen, go to Terminal and use the command as below:
dig -t atlassian-8d2d08._domainkey.test.org CNAMECompare the value with the DNS record value in admin.atlassian.com. The value must be matched.
You can also verify from CNAME lookup from MXToolbox.
Do the same steps for other DKIM values.
To verify the txt for the Verify record
Follow the same steps as for verifying SPF.
Make sure the record value matches. For example:
atlassian-sending-domain-verification=7cdfa26d-9f6c-47ab-abbc-4455a396253cYou can also use the TXT Lookup from MXToolbox.
Once all records have been matched, click Run DNS records check.
It will process for some time. If it is still not updated, give a time and click the button again. It will verify successfully.
If the problem persists, raise a ticket with us, and we will help you investigate further.
DNS changes can take time to propagate. After propagation, re-run the checker at admin.atlassian.com > Settings > Email > Email Domains, and confirm the status flips to VERIFIED.
Was this helpful?