Azure Communication Services Email – SPF verification stuck and DomainNotLinked error when sending emails

Question

I am configuring Azure Communication Services Email with a custom domain.

Resource:

• Azure Communication Services: acs-agirensemble
• Email resource: email-agirensemble

Domain:

• agir-ensemble.be (custom domain)
• DNS hosted at GoDaddy

Current status in Azure portal:

• Domain status: Verified
• DKIM: Verified
• DKIM2: Verified
• SPF: Verification in progress (stuck for several days)

SPF record (single TXT record, no duplicates):

v=spf1 include:spf.protection.outlook.com -all

DNS verification:

Running:

nslookup -q=TXT agir-ensemble.be

Returns exactly one SPF record:

"v=spf1 include:spf.protection.outlook.com -all"

There are no other SPF TXT records for this domain.

No include:spf.messaging.azure.com

No include:spf.azurecomm.net

However, when sending email via Azure Communication Services Email SDK, I receive the following error:

DomainNotLinked – The specified sender domain has not been linked.

Sender address used:

******@agir-ensemble.be

The domain is visible as Verified in the Email Communication Services > Provision domains blade, but SPF verification never completes, and the domain cannot be used for sending.

Request:

• Please recheck or how to force-refresh SPF validation for domain agir-ensemble.be
• Or advise if there is a backend validation issue on Azure Communication Services Email

I have waited more than 72 hours and DNS propagation is confirmed.

Answer 1

Hii Augustin,

It sounds like you're facing issues with your SPF verification remaining stuck and getting a DomainNotLinked error when trying to send emails with Azure Communication Services. Let's break down what you can try:

1. SPF Record Verification: First off, your SPF record appears to be set up correctly: v=spf1 include:spf.protection.outlook.com -all However, make sure there are no other conflicting SPF records in your DNS. You can use nslookup to double-check this by running:

   
      nslookup -q=TXT agir-ensemble.be
   
   

   Ensure that the output shows no duplicates or unexpected entries.
2. SPF Verification Delay: Sometimes, SPF verification can take longer than expected due to DNS propagation issues. Even though you mentioned that propagation is confirmed, it might still be worth setting the TTL (Time to Live) for the SPF record lower (like 300 seconds) to ensure faster updates. After changing this, you might want to refresh your DNS settings in the Azure portal by attempting to verify the domain again.
3. Link the Verified Domain: In the Azure portal, double-check under Email > Connected Domains and ensure that you have attempted to link your verified domain (agir-ensemble.be) to the Email Communication Services resource.
4. Force-Refresh SPF Verification: Unfortunately, there isn't a direct way to force-refresh the SPF verification process. However, rechecking and ensuring all settings are correct, and possibly removing and re-adding the SPF record in your DNS, can help trigger a new check on Azure's end.
5. Backend Issues: If after following these steps the issue persists, there might be a backend validation issue within Azure Communication Services. In that case, it’s advisable to reach out to Azure Support for further assistance.

References:

• Troubleshooting and Configuring Custom Domains and SPF Records https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#2-unable-to-verify-spf-status
• Add Custom Verified Email Domains
  https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/add-custom-verified-domains?pivots=platform-azp
• Connect an Email Communication Resource
  https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/connect-email-communication-resource?pivots=azure-portal
• SPF Records Best Practices

https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-authentication-best-practice#spf-sender-policy-framework

Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "Accept" if the information helped you. This will help us and others in the community as well.

Answer 2

It seems that you are experiencing issues with SPF verification for your custom domain in Azure Communication Services. Here are some steps and considerations that may help you troubleshoot and resolve the issue:

1. SPF Record Verification: Ensure that your SPF record is correctly configured. Your current SPF record looks correct, but Azure Communication Services may require additional entries. You should include the following in your SPF record:

v=spf1 include:spf.protection.outlook.com include:spf.messaging.azure.com include:spf.azurecomm.net -all

This ensures that Azure Communication Services can verify your domain properly.

2. DNS Propagation: Although you mentioned that DNS propagation is confirmed, it can sometimes take longer than expected. You can use online tools to check if the SPF record is visible globally.
3. Check for Multiple SPF Records: Ensure that there are no duplicate SPF records for your domain. Having multiple SPF records can cause verification failures.
4. TTL Settings: Make sure that the Time to Live (TTL) for your SPF record is set to a reasonable value (at least 3600 seconds). This can help with quicker updates and verifications.
5. Azure Support: If the SPF verification remains stuck after making these changes, consider reaching out to Azure Support for assistance. There may be backend validation issues that they can help resolve.
6. Force Refresh: Unfortunately, there is no direct way to force-refresh SPF validation in Azure Communication Services. However, updating your SPF record as suggested and waiting for DNS propagation might trigger a re-evaluation of the record.

By following these steps, you should be able to resolve the SPF verification issue and link your domain for sending emails through Azure Communication Services.