# Troubleshooting DNS

> Fix common DNS verification problems.

Most domains verify within minutes. When one doesn't, it's almost always one of the issues below. Work through them in order — and remember your domain's DNS page shows a live status per record, including the value Faivelo currently sees when there's a **Mismatch**.

## A record is stuck on "Pending"

**Pending** means Faivelo can't see the record on public DNS at all yet.

1. **Confirm it's saved.** The single most common cause: the record is sitting in an edit form at your provider and was never saved. Go back and check it appears in the provider's record list.
2. **Check the name.** Most providers want the relative name (`@`, `_dmarc`, `bounce`) — if you pasted the full name and your provider appended your domain again, you end up with `_dmarc.yourdomain.com.yourdomain.com`, which Faivelo will never find.
3. **Wait for propagation.** New records usually appear within a few minutes, but can take up to 48 hours in rare cases — especially if you recently switched nameservers. Faivelo re-checks automatically every few minutes, so you don't need to babysit it; hit **Re-check All** whenever you want a fresh look.

## A record shows "Mismatch"

A record exists at the right name, but its value is wrong. Faivelo shows you the value it found — compare it character-by-character with the expected one.

- **Typos and stray characters:** extra quotes, a trailing period pasted into a TXT value, or a truncated DKIM token.
- **Leftovers from an old provider:** an old MX or SPF record from your previous email host answering instead of the new one. Delete the old record — don't just add a new one beside it.

## Two SPF records

This one matters most, because it silently breaks deliverability even after verification.

<docs-aside title="A domain may have only ONE SPF record" type="danger">

SPF is the TXT record on your root domain starting with `v=spf1`. If two exist, receiving servers treat SPF as *invalid* — worse than having none. Never add a second one.

</docs-aside>

If you already send mail through another service (Google Workspace, Mailchimp, etc.), **merge** the `include:` mechanisms into a single record. For example, Faivelo's record plus Google Workspace becomes:

```text
v=spf1 mx include:amazonses.com include:_spf.google.com -all
```

Keep exactly one `v=spf1 ...` TXT record on `@`, listing every service that sends for you, ending with a single `-all` (or `~all`).

## Cloudflare: orange cloud breaks mail

Cloudflare can proxy records through its network (the orange cloud icon). That's great for websites and fatal for mail: a proxied record no longer points at the real mail server, so delivery and verification fail.

Set every record Faivelo asks for to **DNS only** (grey cloud) — especially the MX target and the `mta-sts`, `autodiscover`, and `autoconfig` CNAMEs. Also make sure Cloudflare **Email Routing** is off; it injects its own MX records that conflict with Faivelo's. (When you connect Cloudflare with an API key, Faivelo handles both of these for you.)

## Registrar quirks

- **TTL:** leave it at the default (or set 1 hour / 3600). A very long TTL means any mistake takes that long to correct once cached.
- **Namecheap** saves the whole record set at once — if you edit in two browser tabs, the second save can wipe the first. Edit in one place.
- **GoDaddy and Hostinger** sometimes take several minutes to publish saved records to their public nameservers. Saved-but-Pending for 10–15 minutes is normal.
- **Recently transferred domains:** confirm the nameservers actually point at the provider whose dashboard you're editing. Records added at the wrong provider never appear.

## Still stuck?

Re-run the flow from the start: check each record on the [DNS page](https://faivelo.com/domains) against your provider, then **Re-check All**. If your registrar is connected with an API key, **Re-apply DNS records** rewrites the full set in one click. And see [Domain verification](/domains/verification) for how the checks and timing work.