DKIM verification fails in SendGrid
Short answer
DKIM verification in SendGrid almost always fails because the DNS records were not saved exactly as SendGrid lists them. The three most common causes are a domain name added twice to the host field, Cloudflare proxy switched on, and records created as TXT instead of CNAME. Fix the records, check them with a DNS lookup, then click Verify again.
What you see
In SendGrid under Settings > Sender Authentication, your domain shows as failed after you click Verify. The records s1._domainkey and s2._domainkey are marked in red, sometimes together with the em record.
SendGrid will not send email from your domain until every record shows as verified. Sending only works after SendGrid has checked the records, and that check starts when you click Verify. Click Verify after you add the records, even if you know they are correct.
Causes and fixes
1. The domain name is added twice
Many DNS providers add your domain to the host name automatically. If you paste the full name s1._domainkey.yourdomain.com into the host field, the record ends up as s1._domainkey.yourdomain.com.yourdomain.com, and SendGrid cannot find it.
Fix: Enter only the first part in the host field, for example s1._domainkey. Do the same for s2._domainkey and the em record.
2. Cloudflare proxy is switched on
If your DNS is managed in Cloudflare, new CNAME records are often proxied (orange cloud). Cloudflare then answers in place of SendGrid, and verification fails.
Fix: Set all SendGrid records to DNS only (grey cloud).
3. The records are TXT instead of CNAME
With automated security enabled, which is the default, SendGrid asks for CNAME records. A TXT record with the same name and value will not be accepted.
Fix: Delete the TXT records and create them again as CNAME.
4. DNS has not updated yet
Changes usually take effect within minutes, but some providers take several hours, and in rare cases up to 48 hours.
Fix: Check the records yourself (see below). If the lookup shows the correct values and SendGrid still fails, wait an hour and click Verify again.
5. The domain already has DKIM records from another service
If your domain has been set up in SendGrid before, for example in another account or by a website or newsletter tool, s1._domainkey and s2._domainkey may already be in use with different values. You cannot have two records with the same name.
Fix: Authenticate the domain again in SendGrid and choose a custom DKIM selector under advanced settings, for example ill. The records will then be named ill._domainkey and ill2._domainkey and will not collide with the existing ones.
6. Typos or extra characters in the value
A missing character, a space at the end or a value copied from the wrong line is enough to break verification.
Fix: Copy each value directly from SendGrid using the copy button rather than selecting the text by hand.
How to check your records
Run a lookup for each record. On Mac or Linux, open Terminal:
dig CNAME s1._domainkey.yourdomain.com +short
dig CNAME s2._domainkey.yourdomain.com +shortOn Windows, open Command Prompt:
nslookup -type=CNAME s1._domainkey.yourdomain.comThe answer should end in sendgrid.net and match the value SendGrid shows. An empty answer means the record does not exist under that name, which usually points to cause 1 or 4.
Prefer a web tool? Search for any free DNS lookup service, choose record type CNAME and enter the full name, for example s1._domainkey.yourdomain.com.
When to contact support
Contact us if the lookup shows the correct values and SendGrid still fails after 24 hours, or if you do not have access to your DNS. Email support@leadjabber.com with your domain name and a screenshot of the records in your DNS provider.
Did this article solve your problem?