SES Verify DKIM fails with CloudFlare

It sounds like you're having issues with DKIM verification for your domain in Amazon SES while using Cloudflare as your DNS provider.

When verifying DKIM records, there are a few common issues that could cause the "We found the DNS records but the values are wrong" error:

1. Make sure you're adding the CNAME records exactly as provided by Amazon SES. The record names should include the underscore character (_) and should be in the format of something like "ttttttttt._domainkey.mydomain.com".

2. Check that you're using the correct CNAME values for each record. Each of the three DKIM CNAME records should point to different values provided by Amazon SES.

3. If you're using Cloudflare, make sure you have not enabled the "proxy" feature (orange cloud) for these CNAME records. The DKIM records should be DNS-only records (gray cloud in Cloudflare).

4. Some DNS providers, including Cloudflare, may require you to enter only the subdomain part of the record name. For example, instead of entering "ttttttttt._domainkey.mydomain.com", you might need to enter just "ttttttttt._domainkey".

5. DNS propagation can take up to 72 hours, though it's usually much faster. Since it's been a week since you made corrections, this is likely not the issue.

To properly verify your nslookup commands, you should be checking that the CNAME records resolve to the Amazon SES verification values, not to Cloudflare's nameservers. Try running:

nslookup -type=CNAME ttttttttt._domainkey.mydomain.com

The response should show the Amazon SES verification value, not Cloudflare's nameserver.

If you've already corrected the values and are still experiencing issues, you might want to try deleting all the DKIM records and starting the verification process again with fresh records from Amazon SES.
Sources
Domain and Email address verification problems - Amazon Simple Email Service
Setting Up Easy DKIM for a Domain - Amazon Simple Email Service
AWS Certificate verification pending | AWS re:Post

Thanks for the quick reply.

1. Yes it does. I can verify as executing the nslookup command with the CNAME name returns the value
2. True. That was the initial mistake a week ago and was corrected. Now all point to different values and match the values on SES dashboard
3. Proxy is off for the specific CNAME records (actually for all CNAME records I have)
4. Indeed Cloudflare autmatically removes the mydomain.com part and check with nslookup including the mydomain.com returns the value as expected
5. True.

I have added the nameserver as per Amazon Documentation guidelines to trouble shoot. I just ran the same commands again without the nameserver and the values I get are also correct.