Answer first: Amazon SES revokes or fails DKIM verification when the required Easy DKIM CNAME records (or BYODKIM TXT record) become unresolvable or no longer match exactly. After DNS changes the most common causes are the provider automatically appending the domain (creating a double-domain name), a missing trailing dot, case changes, or records not yet visible to SES resolvers. Confirm the exact names and values SES issued, publish them publicly, then wait up to 72 hours or re-enable Easy DKIM.
Why DKIM Verification Breaks After It Worked
SES continuously checks that the DKIM records it issued are still present and correct. If they disappear, change, or cannot be resolved over public DNS, SES disables signing and may email that the setup will be revoked. This is distinct from the initial verification process covered in our How to Verify a Domain in Amazon SES (Easy DKIM) guide and from never-verified “stuck pending” cases in Amazon SES Domain Verification Stuck.
Easy DKIM uses three CNAME records of the form selector._domainkey.example.com pointing at selector.dkim.amazonses.com. BYODKIM uses a single TXT record containing the public key. Exact match is required.
Ordered Diagnostic Steps
- Confirm what SES currently expects. In the SES console open the domain identity, note the exact CNAME (or TXT) names and values, and the region/account. Verification is regional.
- Query the published records from public resolvers. Use
dig CNAME selector._domainkey.example.com +shortor an online checker. Also test the doubled form (…example.com.example.com) in case the provider appended the domain. Our How to Check DKIM Status and free tools at /tools help here. - Compare name and value character-for-character. Look for extra dots, missing underscores, lowercase mutation of the value, or a missing trailing dot that caused the provider to append the apex domain.
- Check propagation and visibility. SES may take up to 72 hours to see changes. SERVFAIL on TXT queries while CNAME succeeds can also block verification.
- Rule out private DNS or wrong region. Records must be publicly resolvable. Confirm you are looking at the same AWS account and region where the identity was created.
Most Common DNS-Provider Pitfalls
- Automatic domain append: Entering the full name causes the provider to create
selector._domainkey.example.com.example.com. Fix by entering only the relative name or by adding a trailing dot. - Case or whitespace changes: Some providers force lowercase or strip characters. SES requires an exact match to the value it issued.
- Missing or incomplete set: All three Easy DKIM CNAMEs must be present. One missing selector fails the whole configuration.
- Provider does not allow underscores: Rare, but some older DNS interfaces block
_domainkey. Contact the provider; the underscore is required by the DKIM specification. - Recent cutover or migration: After moving DNS providers, old records may still be cached or new records may not yet be authoritative for SES’s resolvers.
How to Fix and When to Re-add the Identity
Correct the records so they resolve exactly as SES expects, then wait. If verification remains failed after 72 hours and external checks confirm the records are correct, disable Easy DKIM and re-enable it (or delete and re-create the identity) to force SES to re-check. Do this only after confirming the DNS is public and exact; otherwise you simply regenerate the same problem.
For broader authentication context see SPF, DKIM, and DMARC explained and Email Authentication Troubleshooting.
How This Differs from ArawaMail Sending Setup
ArawaMail publishes its own DKIM CNAME records automatically via Cloudflare when you activate sending. This article is specifically about Amazon SES domain identities. Do not mix the two sets of records. ArawaMail DNS reference: ArawaMail DNS Records. For teams evaluating managed alternatives, see ArawaMail vs Amazon SES.
How We Analyzed This
Steps and failure modes come from current AWS troubleshooting documentation for DKIM and domain verification, plus recurring patterns in AWS re:Post threads through 2026 (double-domain names, trailing dots, 72-hour windows, regional scope). No invented hostnames or success rates.
FAQ
Why did SES email that DKIM will be revoked after I changed DNS?
SES could no longer resolve the exact CNAME or TXT records it issued. The most frequent trigger is a DNS-provider append that created a doubled domain name, or records that have not yet propagated to the resolvers SES uses.
How do I confirm the records match what SES expects?
Copy the exact names and values from the SES console, then query them with dig/nslookup against public resolvers (and the doubled form). Values must match character-for-character, including case.
How long should I wait after fixing DNS?
Up to 72 hours is normal. If external checks already show the correct records and status remains failed, re-enable Easy DKIM or recreate the identity.
Is this the same as initial verification stuck in pending?
No. Initial pending usually means the records were never correctly published. This article covers cases where verification previously succeeded and later failed after DNS edits.
Can I use the same DKIM records for ArawaMail and SES?
No. Each platform issues its own selectors and targets. Publish the records each service requires separately.