iCloud Custom Domain Not Verifying: DNS Fixes That Work

When an iCloud custom domain is not verifying, the DNS almost always disagrees with what Apple expects. iCloud checks your domain's public records against a specific set it generates for you, and if even one record is missing, mistyped, or living on the wrong host, the domain sits on Pending and mail either bounces or never routes. This is a troubleshooting guide for a domain that is stuck — not a from-scratch setup, which the companion setup guide covers.

The good news is that the failures come from a short list of causes: conflicting MX records left over from a previous email provider, a verification TXT record published at the wrong place, DNS that simply hasn't propagated, and authentication records (SPF and DKIM) that need to be present before mail flows cleanly. Each one has a clean fix, and the iCloud setup screen tells you exactly which records it is still waiting on.

The short answer#

Open the Custom Email Domain screen at iCloud.com, select your domain, and read the exact records iCloud is asking for. Then, at your domain registrar, make your DNS match it: delete any MX records that don't point to iCloud, publish the apple-domain verification TXT at the root of the domain, and add the SPF TXT and DKIM CNAME. Save, wait for DNS to propagate, and click Verify again.

Two rules cover most stuck domains. First, iCloud must be the only mail exchanger — a single leftover MX from Google Workspace, a previous host, or a registrar's email-forwarding feature is enough to break verification and delivery. Second, the values are Apple-generated and per-domain, so copy them exactly from the iCloud screen rather than from any guide, including this one. Punctuation and the unique strings matter.

Before you start: what you need#

Custom Email Domain is part of iCloud+, so the account must have an active paid iCloud+ subscription (as of August 2026). You also need to own the domain and be able to edit its DNS at whatever registrar or DNS host manages it — GoDaddy, Namecheap, Cloudflare, Squarespace, or another. Finally, the domain can't already be assigned to another Apple Account or another Apple service; if it is, you'll have to release it there first.

Have two things open side by side: the iCloud Custom Email Domain screen (this is the source of truth for the exact record values) and your registrar's DNS panel (where you actually publish them). During setup, Apple can update the records automatically at some registrars if you sign in; if yours isn't supported, or that step failed, you'll add every record by hand.

The records iCloud needs#

iCloud verifies a domain against four kinds of record: a verification TXT, two MX records, an SPF TXT, and a DKIM CNAME. The table below shows the shape and the values iCloud typically displays — but the apple-domain string and the DKIM target are generated for your specific domain, so always copy the exact values from the iCloud setup screen.

How to fix a domain stuck on Pending, step by step#

Work through these in order at your DNS host, saving each record before starting the next. Keep the iCloud setup screen open in another tab to copy from.

1. 1

   Read the exact records iCloud is asking for

   Sign in at iCloud.com, open Custom Email Domain, and select your domain. iCloud shows the exact MX, TXT, SPF and DKIM records it expects, plus the current status. Treat this screen as the source of truth — Apple generates the DKIM key and the apple-domain verification string uniquely for your domain.

2. 2

   Remove conflicting MX records

   In your registrar's DNS panel, delete every MX record that doesn't point to iCloud — an old Google Workspace set (aspmx.l.google.com and friends), a previous host, or the registrar's default email-forwarding MX. iCloud must be the only mail exchanger. Leave only mx01.mail.icloud.com and mx02.mail.icloud.com, both at priority 10.

3. 3

   Publish the verification TXT at the root

   Add a TXT record on the root of the domain, with the exact apple-domain=... value iCloud shows. In most panels the host is just @ — don't put it on a subdomain like apple-domain.yourdomain, and don't type your full domain into the host field, because the panel usually appends it for you and creates a doubled hostname.

4. 4

   Add SPF and DKIM

   Add the SPF record as a TXT at the root with the value v=spf1 include:icloud.com ~all, and the DKIM record as a CNAME at sig1._domainkey pointing to the icloudmailadmin.com target iCloud gives you. If you already publish an SPF record, do not add a second one — merge include:icloud.com into the existing v=spf1 string instead.

5. 5

   Wait for propagation, then re-verify

   Save everything, then give DNS time to update — usually minutes, occasionally up to a day if a high TTL is still serving the old answer. Return to the iCloud setup screen and click Verify. When each record turns green, the domain moves from Pending to active and you can start adding addresses.

Where you manage the domain, by device#

You can view a custom domain's status on any Apple device, but the actual DNS edits always happen at your registrar, never on the phone or Mac. Paths vary slightly by OS version.

What to do when it still doesn't verify#

If the domain won't leave Pending, match your symptom to the table and fix that one cause. The fastest diagnostic is to query your domain's records with any public DNS lookup tool and compare what returns to what the iCloud screen expects — the mismatch usually points straight at the problem.

When nothing else works: remove and re-add the domain#

If the records are correct, the conflicts are gone, and you've waited out propagation but the domain still won't verify, removing it from iCloud and adding it again forces a clean re-check. This clears a half-finished setup and a stale verification token, which is often what a genuinely stuck domain is holding onto.

Do this last, not first. Removing a domain stops iCloud delivering mail to its addresses, and you'll re-create every custom address afterward. If mail is already flowing to the domain, a remove-and-re-add is disruptive, so exhaust the record fixes above before you reach for it.

A faster way — after the domain verifies#

Setting up iCloud's records is a one-time job, and it's entirely Apple's and your registrar's — a mail client can't verify a domain or edit DNS for you, and AI Emaily doesn't try to. We are not a DNS host or a domain-setup tool, and this guide's fixes stand on their own whether or not you ever use us.

The adjacent thing we do starts once the domain is verified and mail flows. AI Emaily connects to your iCloud mailbox over IMAP and becomes the inbox you actually work in: it triages what lands there, drafts replies in a voice you set, and closes loops — with approve-before-send, undo, and a full audit trail, and no training on your mail. It also reads SPF and DKIM results on incoming mail to help flag spoofed senders. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans (card required, $0 if you cancel before day 7). It doesn't replace iCloud — it sits on top of the mailbox you just fixed.