DKIM2 Validation for ACS Resource in Azure

Cameron Oberg 20 Reputation points
2026-09-21T14:56:12.44+00:00

My client uses a GoDaddy Email domain for internal forms, and I've recently attempted a modernization of their site using Microsoft Document Intelligence + Azure Email Communication Service

They are a non technical user, so setting up the DNS records proved to be a painful process. However, we where able to set up TXT, SFP and DKIM successfully though the Azure portal. DKIM2 however, still returns a pending state, despite sending out the request more than 48 hours ago. I've confirmed that the information is correct, checked custom domain cases, and found similar instances of users who had this problem on these forms. To me, from what I can see, this is getting stuck on Azure's backend, which is frustrating, because I need to have my connection string to test my app's email capabilities.

An nslookup proves that it should be wired correctly.
User's image

In the resource itself via Azure Portal:
Screenshot 2026-09-21 102817

Let me know how I can move forward.
Cameron

Azure DNS
Azure DNS

An Azure service that enables hosting Domain Name System (DNS) domains in Azure.

0 comments
Answer accepted by question author
TP 163.5K Reputation points Volunteer Moderator
2026-09-21T15:36:05.73+00:00

Hi Cameron,

Please follow instructions below to remove and re-Add your custom domain to your Email Communication Service (ECS). In most cases this will fix the issue you are seeing.

1. Edit the TTL for you SPF TXT record and set it to low value (e.g. 300 or 600 seconds).

2. Delete the verification TXT record (ms-domain-verification). Leave the DKIM/DKIM2 CNAME records as they are now.

3. Wait 1 hour for TTL to expire

4. In Azure portal, navigate to your Email Communication Service -- Settings -- Provision domains, click on context menu (three dots) to the right of your custom domain, select Remove, confirm. Wait for the notification message letting you know that the domain has been removed.

5. Add your custom domain to your ECS under Provision domains. Create new verification DNS TXT record, only this time give it low TTL like 300 or 600 seconds. This will help speed up troubleshooting.

6. Periodically click Refresh button to see if verification is finished. Usually you will see the Domain status switch to Verified within about 10-15 minutes and then almost instantly SPF/DKIM/DKIM2 will also switch to Verified. Sometimes you may need to click Configure for SPF or DKIM or DKIM2 and go through the wizard on right, but then when you close that and refresh they will switch to Verified.

7. Once everything is working properly, go back and edit TTLs to be what they were before. For example, 3600 (1 hour) for your SPF TXT record. I only wanted you to use low TTLs during troubleshooting.

Please reply back with your results, whether positive or negative.

Thanks.

-TP

Was this answer helpful?

1 person found this answer helpful.

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Cameron Oberg 20 Reputation points
    2026-09-21T21:53:49.23+00:00

    I just needed to add a communications resource and link my email resource to it to expose the keys. Domain related workaround suggestion fixed the DKIM2 problem.

    Was this answer helpful?

    0 comments
  2. Cameron Oberg 20 Reputation points
    2026-09-21T21:42:19.6066667+00:00

    User's image

    Re-authoring the TXT solved my initial issue. But despite the verification, it did not yet expose a Keys & Connection Strings section will under the Communication Service resource. Perhaps this just needs a refresh?

    Was this answer helpful?

    0 comments
  3. Cameron Oberg 20 Reputation points
    2026-09-21T21:41:44.0633333+00:00

    This issue has been solved.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.