DNS record verification statuses reference

This page describes the DNS records MapleGather needs — the ownership record, then SPF, DKIM, and DMARC — the verification states each record can be in, and common setup notes for each record type.

The ownership record

When you save a From address at a domain your organization doesn’t already use, MapleGather first shows one record that proves your organization owns the domain, on a card headed Prove you own followed by your domain. [amended pre-merge 2026-10-21, c21 track BQ]

Record	Type	Host	Value
Ownership	TXT	`_maplegather-verify.` + your domain	`maplegather-verify=` followed by a 64-character code generated for your organization and this domain only

Badge	What it means
Pending	The record hasn’t been checked yet. Publish it, then select Check ownership — the open page also checks automatically (“Checking for the ownership record automatically…”). Nothing is reserved for your organization yet, and no other organization is blocked.
Not found yet	The last check didn’t find the record with your organization’s value, or couldn’t read your DNS. The page says Ownership record not found yet and why. Nothing was reserved or changed. Correct the record if needed and check again. DNS changes can take up to 48 hours.

There is no Verified badge: once the record is found, the domain becomes your organization’s (the first organization to prove a domain gets it), the card goes away and the three records below appear. Until then your current From address stays in use. The check has no expiry. Re-saving the same domain keeps the same value, and saving a different domain replaces the record. Quoted or split TXT values are accepted.

DNS record types

Once ownership is proven (see The ownership record above), MapleGather registers your domain with its email provider and shows three DNS records to publish. All three must verify before your email goes out from your own address. Each record card shows the record’s Type, Host, and Value.

Record	Type	Host	Purpose
SPF (Sender Policy Framework) — the Return-Path record	CNAME	`pm-bounces.` + your domain	Lets receiving mail servers confirm that MapleGather’s email provider is allowed to send for your domain. It is checked on a separate bounce (Return-Path) subdomain, so your domain’s existing SPF record isn’t edited.
DKIM (DomainKeys Identified Mail)	TXT	a name ending in `._domainkey.` + your domain, set by the email provider	Publishes the public half of the key that signs each outgoing email, so receivers can verify the message wasn’t altered and genuinely came from your domain.
DMARC (Domain-based Message Authentication, Reporting & Conformance)	TXT	`_dmarc.` + your domain	Tells receiving servers what to do when an email fails SPF or DKIM checks.

Copy each Host and Value from its card — they’re specific to your domain.

DNS verification states

Each record card shows one of these states:

State	Badge	What it means
Not set up	Gray	No domain is registered yet — no From address has been saved, or its ownership hasn’t been proven. [amended 2026-10-21, c21 track BQ]
Pending	Amber	The record is waiting to be verified. Publish it at your DNS provider, then select Verify — or keep the deliverability page open, which re-checks it automatically. [amended pre-merge 2026-10-20, c21 E panel-r2]
Verified	Green	The record is in place and valid. SPF and DKIM are verified by MapleGather’s email provider; DMARC by a DNS lookup. Each check also looks your DKIM record up in DNS, so a DKIM record that is later removed or changed shows Failed again. [amended pre-merge 2026-10-20, c21 E panel-r2]
Failed	Red	The check didn’t find a valid record. The card says why — check that the Type, Host, and Value match the card exactly.

While a check is running, the button you selected shows a spinner and the cards keep their last state until the page re-reads it. Records are re-checked when an admin selects Verify, or while the deliverability page is open: while any record isn’t verified, or a DKIM rotation is waiting for its record, the open page checks again every 30 seconds — up to 20 times per visit, paused while the tab is hidden — and shows Checking DNS again automatically…. Nothing checks your records while the page is closed [amended pre-merge 2026-10-20, c21 E panel-r2]; after that it shows Automatic checks paused. Use Verify all records to check again. If a check itself is refused, the page says so in its own message (for example, “The email provider is unavailable. Try again in a few minutes.”) and no record is marked Failed.

Which address your email goes out from

Once a domain is registered for your organization, the deliverability page says which address your email is going out from (while ownership is pending, the ownership card names the current sender instead — “Until then, mail keeps going out from …”) [amended pre-merge 2026-10-21, panel r1]:

Message	When
Email is sending from a functional fallback	Any record isn’t verified. Mail goes out from your organization’s fallback address — for example, `riverside-club@notifications.maplegather.com` — and the message names it.
Email is sending from MapleGather’s address	Any record isn’t verified, and mail goes out from MapleGather’s own sending address (`no-reply@maplegather.com`) instead of an organization fallback — for example, when your organization’s short name reads like a role mailbox such as `support` or `billing`. The message names it. [amended pre-merge 2026-10-20, c21 E panel-r2]
Sending from your domain	All three records are verified. Mail goes out from your From address, and the message names it.

The fallback covers everything your organization sends to members and contacts — broadcasts, automatic and transactional email, and the test send. If a record stops verifying later, mail goes back to the fallback the next time the records are checked (an admin selects Verify, or the deliverability page is open). [amended pre-merge 2026-10-20, c21 E panel-r2]

Notes by record type

SPF

The SPF record is a CNAME at pm-bounces. followed by your domain. You don’t need to merge anything into your domain’s existing SPF record.

DKIM

The DKIM key is generated by MapleGather’s email provider when you save your From address. MapleGather never generates or holds the key.
When you rotate DKIM, a New DKIM key card shows the new key’s record — at a new Host — with the date the rotation started. Keep your current DKIM record: the current key keeps signing until the new record verifies, then the new key takes over and the card disappears.
If the new record hasn’t verified within 7 days, the dashboard shows DKIM rotation incomplete — verify DNS record. See DKIM rotation overdue.

DMARC

The DMARC record value must start with v=DMARC1 in uppercase. Using lowercase v=dmarc1 is a common mistake that causes verification to fail. The value shown on the record card is correct — copy it exactly.
Some DNS providers (including Cloudflare) automatically wrap TXT record values in double quotes, or split long values. MapleGather accepts both — don’t add your own quotes on top of what the provider adds.

From addresses MapleGather can’t use

Message	Why
Another organization proved this domain first, so it can’t be used here. Use an address at a different domain your organization controls.	Shown by Check ownership: each domain can belong to only one organization in MapleGather — the first to prove it owns it. The other organization is never named, and the domain stays registered to it; MapleGather has no way to move a proven domain to another organization. The automatic checks stop: Automatic checks stopped. Change to an address at a domain your organization controls. [amended pre-merge 2026-10-21, c21 track BQ; 2026-11-01, c21 track CM]
Our email provider can’t register this domain. Use a domain your organization controls.	Shown by Check ownership: ownership was proven, but MapleGather’s email provider refused to register the domain. Nothing was reserved; use an address at a different domain. The automatic checks stop. [amended pre-merge 2026-10-21, c21 track BQ; 2026-11-01, c21 track CM]
Our email provider already has a record for this domain that no organization here holds, so it can’t be added, and MapleGather doesn’t take over or remove such a record automatically. Use an address at a different domain.	Shown by Check ownership: no organization in MapleGather holds the domain, but MapleGather’s email provider already has a record for it — an orphan no organization here holds (possibly your own organization’s earlier attempt that timed out) or one from another MapleGather environment; MapleGather can’t tell which. MapleGather never takes such a record over or removes it, and nothing in MapleGather can release it; use an address at a different domain. The automatic checks stop: Automatic checks stopped. Change to an address at a domain your organization controls. [amended pre-merge 2026-10-20, c21 E panel-r2; 2026-11-01, c21 track CM]
Your record was found, but our email provider didn’t give a usable answer. Nothing is reserved yet — try again in a few minutes.	Shown by Check ownership: your ownership record was found, but MapleGather’s email provider didn’t respond, or gave an answer MapleGather couldn’t use, just then. Nothing is reserved, and your ownership record stays valid. The open page keeps checking automatically; you can also select Check ownership again in a few minutes. [amended 2026-11-01, c21 track CM]
Your record was found, but our email provider account isn’t connected on MapleGather’s side, so domains can’t be added right now. Nothing is reserved, and your email keeps going out from the address it uses now.	Shown by Check ownership: MapleGather’s own email provider account isn’t connected, so no domain can be added right now. Waiting a few minutes won’t change this, so the automatic checks stop: Automatic checks stopped. Checking again won’t help until MapleGather’s email provider account is connected. Your ownership record stays valid, and your email keeps going out from the address it uses now (your current verified domain, if you have one, or the fallback address). (Verify and Rotate DKIM refuse with the same cause.) [amended 2026-11-01, c21 track CM]
Use an address at your organization’s own domain.	MapleGather’s own domains and public email providers (such as Gmail, Yahoo, Outlook, AOL, AIM, and iCloud) can’t be verified by any organization. Internationalized domains that only look like one of them (for example, `maplegather.com` spelled with a Cyrillic “а”) are refused the same way. [amended pre-merge 2026-10-21, c21 track BQ]

Deliverability metrics

Metric	Alert threshold
Bounce rate (7-day)	Alert when > 2%
Delivery rate	Reference only
Sender reputation	Reference only