Troubleshooting

Each check on the domain card in Settings › Domains comes with a message, such as "Return path: the MX record of bounce.acme.com is not published yet". Find the matching symptom below.

Check the records yourself

Before changing anything, query public DNS with dig (replace acme.com and the DKIM token):

dig +short CNAME abc123._domainkey.acme.com   # → abc123.dkim.amazonses.com.
dig +short MX bounce.acme.com                 # → 10 feedback-smtp.eu-west-3.amazonses.com.
dig +short TXT bounce.acme.com                # → "v=spf1 include:amazonses.com ~all"
dig +short TXT _dmarc.acme.com                # → "v=DMARC1; p=none;"
dig +short CNAME link.acme.com                # → track.kulamail.com.

An empty answer means the record isn't published, or not under that name. No terminal at hand? Any online "DNS lookup" tool gives the same answer.

The record was just added

DNS changes usually spread in a few minutes, sometimes up to an hour, rarely more. Kula keeps checking on its own (every 15 minutes at first). Click Check now to force a check.

If dig shows the right value and the check is still pending after an hour, contact support.

The domain appears twice in the name

Many DNS providers append your domain to every name you type. If you enter bounce.acme.com, the record ends up on bounce.acme.com.acme.com and the check never finds it.

Enter only the part before your domain:

When you send from a subdomain such as mail.acme.com and your DNS zone is acme.com, keep the subdomain part: bounce.mail, link.mail, _dmarc.mail.

Cloudflare: the tracking or DKIM check fails

Cloudflare proxies CNAME records by default (orange cloud). A proxied CNAME answers with Cloudflare's own addresses instead of the target, so the check sees a wrong value.

Set the DKIM and link records to DNS only (grey cloud). The tracking subdomain needs it too: Kula issues the HTTPS certificate for link.acme.com itself, which doesn't work behind Cloudflare's proxy.

"Points to the wrong value"

The record exists but its value doesn't match. Common causes:

• a typo, or a value cut short when copying: use the copy buttons in Kula;
• a trailing dot or quotes added by hand in a field that doesn't expect them;
• an old record left over from a previous email tool, under the same name. Delete it and keep only Kula's.

You already have an SPF record

Kula's SPF record goes on bounce.acme.com, not on acme.com. Your main domain's SPF record (for Google Workspace, Microsoft 365…) stays as it is, and you don't need to add amazonses.com to it.

If bounce.acme.com already has a TXT record starting with v=spf1, it must include include:amazonses.com. A name can only have one SPF record: merge them rather than adding a second.

You already have a DMARC record

Keep it. Kula accepts any valid record starting with v=DMARC1, on the sending domain or, for a subdomain, on the main domain.

A strict policy (p=quarantine or p=reject) works too: emails sent through Kula pass DKIM with your domain, so they're aligned.

The return path MX conflicts with another record

The MX record goes on bounce.acme.com, a subdomain only used for bounces. It never replaces the MX of acme.com, so your mailbox keeps receiving email.

If the check says the MX of bounce.acme.com must point to feedback-smtp.eu-west-3.amazonses.com, another MX already exists on that name. Delete it: nothing else should receive mail on bounce.acme.com. Some providers also refuse a CNAME and an MX on the same name; bounce needs only the MX and the TXT.

The domain was verified and is now pending

Kula checks verified domains every day. A record has disappeared, often after moving the domain to another DNS provider or cleaning up the zone. Sending from this domain stops until it's back. Publish the missing record again and click Check now.

"Already used by another space"

A domain belongs to a single space. Remove it from the other space first, or use a different subdomain, such as news.acme.com, for the second space.

Still stuck?

Write to support@kulamail.com with your domain name.