DNS record verification statuses reference

This page describes the SPF, DKIM, and DMARC DNS records MapleGather needs, the verification states each record can be in, and common setup notes for each record type.

DNS record types

MapleGather requires three DNS records to verify your sending domain. All three are needed for the best deliverability.

Record type	Purpose
SPF (Sender Policy Framework)	Tells receiving mail servers that MapleGather is authorized to send email on behalf of your domain. Reduces the chance your emails are marked as forged.
DKIM (DomainKeys Identified Mail)	Adds a cryptographic signature to each outgoing email, letting receivers verify that the message wasn’t altered in transit and genuinely came from your domain.
DMARC (Domain-based Message Authentication, Reporting & Conformance)	Tells receiving servers what to do when an email fails SPF or DKIM checks and gives you a policy for handling unauthenticated messages.

DNS verification states

Each record card on the deliverability dashboard shows one of these states:

State	Badge	What it means
Unverified	Gray	The record hasn’t been checked yet. Add the DNS record and select Verify.
Verifying	Blue	MapleGather is checking your DNS for the record. This usually resolves within a minute.
Verified	Green	The record is in place and valid.
Failed	Red	MapleGather couldn’t find a valid record at the expected host. Check that the Host and Value match exactly.
Expiring	Amber	Your DKIM key is close to its recommended rotation period. Plan to rotate soon.

Notes by record type

SPF

Only one SPF TXT record per domain is allowed. If your domain already has an SPF record, merge the MapleGather include directive into it rather than adding a second record.
The record is a TXT record at your root domain (for example, @ or yourorg.org).

DKIM

Rotate your DKIM key periodically. When you rotate, the old key stays valid for 7 days before the new key takes over exclusively.
After day 7, the dashboard shows a badge progressing through Expiring → Rotation overdue if the DNS record isn’t updated to the new key.
The record type may be a CNAME or TXT depending on your DNS provider’s requirements — use whichever type MapleGather specifies on the record card.

DMARC

The DMARC record value must start with v=DMARC1 in uppercase. Using lowercase v=dmarc1 is a common mistake that causes verification to fail. The value shown on the record card is correct — copy it exactly.
Some DNS providers (including Cloudflare) automatically wrap TXT record values in double quotes when you enter them. Don’t add your own quotes on top of what the provider adds.

Functional fallback From address

While your DNS records are unverified, MapleGather sends from a functional fallback address — for example, yourorg@notifications.maplegather.com. Members see this as the sender until DNS setup is complete. All emails still deliver during this period, but your organization’s domain isn’t in the From field.

Deliverability metrics

Metric	Alert threshold
Bounce rate (7-day)	Alert when > 2%
Delivery rate	Reference only
Sender reputation	Reference only