Open the domain's detail panel. Winnr shows which specific record is failing. Click "Show expected value" for that record — you get the exact Type, Name, and Value Winnr wants. Compare to what's at your DNS provider. Most failures are typos in the value, records added at the wrong name (e.g., @ vs the apex), or an old conflicting record overriding Winnr's.
Per-record diagnosis
SPF (TXT at apex)
- Failing to appear at all — you added the record but not at the right name. SPF goes at the apex (
@or empty name field at most providers). Not atspf.yourdomain.comor anything else. - Wrong value — TXT records must be quoted in most DNS provider UIs. Some UIs handle quotes automatically, others require you to add them. Try with and without quotes.
- Multiple SPF records — RFC violation. Remove all but one; merge include statements into a single record.
DKIM (TXT at dkim._domainkey)
- Wrong name — the Name field should be
dkim._domainkey, exactly. Notdkim._domainkey.yourdomain.com(some providers append the domain automatically; some don't). - Truncated value — DKIM values are long. Some DNS provider UIs truncate at ~255 characters. Check for a "split TXT record" option or a "long TXT" feature.
- Line breaks or spaces — pasting the DKIM value with a line break inside can break parsing. Should be one continuous string.
DMARC (TXT at _dmarc)
- Wrong name —
_dmarc, exactly. Underscore prefix matters. - Malformed value — must start with
v=DMARC1;followed by a policy (p=rejectby default, orp=quarantine/p=none) and other tags. Extra spaces or missing semicolons break it.
MX (at apex)
- Wrong priority — Winnr's MX uses priority 10. If your DNS provider requires you to type "10" and the hostname, get the priority right.
- Wrong hostname — must be exactly what Winnr shows. Extra
.at the end or missing subdomain part breaks it. - Conflicting MX — remove any default MX your registrar added.
Waiting is sometimes the answer
DNS caches globally at different rates. If you've verified the record is correct at your DNS provider and Winnr still says failing:
- Wait 15 minutes.
- Click Recheck DNS.
- If still failing after 30 minutes, contact support with a screenshot of your DNS records.
TTL settings determine cache lifetime. If your provider defaults to 24 hours TTL, changes can genuinely take that long. Set TTL to 3600 (1 hour) for future changes.
What's next
Frequently asked questions
How do I know which record is failing?
Domain detail panel shows a health section listing each record with green/yellow/red status. Red = failing. Click for details.
What if I can't tell what's wrong even after comparing?
Copy the current record from your DNS provider (whatever's actually there) and compare it character by character with Winnr's expected value. DKIM values especially can look nearly identical but have one character off.
DKIM specifically won't verify. Why?
DKIM values are long — often 300+ characters. Common issues — copied without trailing characters, line breaks introduced by your DNS provider's UI, or the value split across two records when it should be one long TXT.
The SPF record includes something else. Do I remove that?
Yes — you can only have one SPF record at the apex. If your existing SPF includes Google or Microsoft or Mailgun, you need to merge them into one record (v=spf1 include:... include:... -all) or remove the ones you don't need. Winnr's Connect Domain flow shows you the required SPF; the merge is on you.
MX record won't verify.
Almost always because your registrar has a default MX pointing at their own mail service. Delete the default record, add Winnr's MX with priority 10.