---
title: "Why does my domain stay at Authentication Pending in Catalyst Mail after I add the SPF and DKIM records?"
url: https://docs.catalyst.zoho.com/en/faq/cloud-scale/mail-domain-authentication-pending/
description: "In Catalyst CloudScale Mail, a domain is authenticated only when Catalyst finds both the SPF and the DKIM record it generated for that domain in public DNS, …"
last_updated: 2026-11-13T05:00:22Z
service: CloudScale
type: faq
---

In Catalyst CloudScale Mail, a domain is authenticated only when Catalyst finds both the SPF and the DKIM record it generated for that domain in public DNS, exactly as the console shows them. The usual causes are a DKIM record with the wrong host name or value, a second SPF record on the domain, or an SPF value typed by hand.

1. In the Catalyst CloudScale console, go to **Notify** → **Mail** → **Domain** and click **Validate** for the domain to see its SPF and DKIM codes.

2. Add the DKIM record exactly as shown.

3. Copy the SPF value from the console, not from an example, because it can differ by data center.

4. A domain can have only one SPF record. If one exists for another mail service, add the Catalyst `include:` value to it instead of adding a second record, keeping one `all` term at the end. SPF also limits DNS lookups per record, so remove includes you no longer use.

5. Check both records with a public DNS lookup tool, wait for them to propagate, then click **Authenticate** in the **Authenticate Domain** pop-up.

Note: If both records are publicly visible and match the console but the domain stays pending, contact Catalyst support with the domain, the project and your data center.

Refer to the [Domains help page](https://docs.catalyst.zoho.com/en/cloud-scale/help/mail/domains/) for more information.