DNS Workmail verification not propagating after more than 72 hours

Question

I have recently ported a domain on to AWS, and I had workmail set up with that third party hosting site. I have since moved everything on to AWS and have updated my DNS records on Route53 using the automated 'Update all in Route 53' button. I have also added the correct CNAME records for DKIM through Route 53 as well.

It has been over 72 hours since updating and the status of each new record is either 'Missing' or 'Pending'.

Chatting to Amazon Q, I was asked to verify the following steps:
* **Verify DNS record accuracy** - this was automated so no chance of human error
* **Confirm that the nameservers listed in your domain registration settings match those in your Route 53 hosted zone** - these match
* **Check the Time-to-Live (TTL) values for the WorkMail verification records** - 600s
* **Use online DNS lookup tools (like dig, nslookup, or online services) to check if the records are visible from different locations** - No CNAME or TXT records found using nslookup, everything else matches and there is one inbound MX record

As expected I get a delivery failure notification when sending a test email to this address.

re:Post Agent · Answer

Based on your situation, there are several potential reasons why your WorkMail verification records aren't propagating after 72 hours:

1. **Nameserver Configuration Issues**: Even though you've confirmed that the nameservers in your domain registration match those in Route 53, there might be an issue with glue records. When transferring domains to AWS, it's important to ensure that the glue records are properly updated to point to the Route 53 nameservers.

2. **DNS Propagation Delays**: While DNS changes typically propagate within 48-72 hours, some resolvers may cache information for longer periods. In some cases, DNS resolvers request NS records only once every two days and cache the answer, which can extend propagation time.

3. **Multiple Hosted Zones**: Check if you have multiple hosted zones with the same domain name. If so, ensure you're updating the correct one and that your domain registration is using the nameservers from the correct hosted zone.

4. **Record Format Issues**: Even though you used the automated "Update all in Route 53" button, verify that the CNAME and TXT records are formatted correctly. Some DNS providers automatically modify record values, which can cause verification issues.

Since nslookup isn't finding your CNAME or TXT records, this suggests that either:
- The records weren't properly created in Route 53
- The records exist but aren't being served by your nameservers
- There's an issue with the domain's delegation to Route 53

Recommended next steps:
1. Double-check your hosted zone to ensure all required WorkMail records are present
2. Verify that your domain is using the correct Route 53 nameservers
3. Try using different DNS lookup tools like MXToolbox or IntoDNS to get a broader picture of your DNS propagation
4. If issues persist, consider opening a case with AWS Support under the "Account and Billing" category, which can be done free of charge for domain-related issues  
**Sources**  
[Domain records not verified | AWS re:Post](https://repost.aws/questions/QU6rZUNyQGSF2ge69n4KdYUA/domain-records-not-verified)  
[Migrated domain to AWS and DNS not working in many places | AWS re:Post](https://repost.aws/questions/QUqz-4R9dPSzC5nkVHzZOvWg/migrated-domain-to-aws-and-dns-not-working-in-many-places)  
[Email DNS Issues after Transfer to AWS Route 53 | AWS re:Post](https://repost.aws/questions/QUsfch-n-VRkm23IEwygLUrA/email-dns-issues-after-transfer-to-aws-route-53)  
[DNS Propogation seems to have stalled. | AWS re:Post](https://repost.aws/questions/QUpPmmbUVwQkifUO3IbWabWg/dns-propogation-seems-to-have-stalled)

DNS Workmail verification not propagating after more than 72 hours

Add your answer

Relevant content