DKIM2 Status stuck on "Canceling"

Montet 20 Reputation points
2026-09-08T17:40:58.48+00:00

I have a provisional domain for an Email Service that I'm trying to verify.

Domain Status: Verified
SPF Status: Verified
DKIM Status: Verified
DKIM2 Status: Canceling

The DKIM2 DNS record resolves correctly via public DNS. It was stuck on "Verifying" for over 24 hours, so I hit "Cancel". Now it has been stuck on "Canceling" for four days. I can't restart the verification process because of this. Any idea how to break out of the canceling status?

Azure Communication Services
0 comments
Answer accepted by question author
Allan Solomon Mejia 7,915 Reputation points
2026-09-08T20:15:12.4466667+00:00

Hi @Montet

Since the Domain, SPF, and DKIM checks are already Verified, and you’ve confirmed that the DKIM2 CNAME resolves correctly through public DNS, a DKIM2 status stuck at Canceling for four days is unlikely to be normal DNS propagation.

ACS normally expects the DKIM/DKIM2 CNAME records to become publicly resolvable before verification completes, and DNS changes typically take around 15–30 minutes to propagate for this process.

There have also been similar ACS Email cases where the domain verification state became stuck in the backend even though the DNS records were correct. In one recent case, Microsoft confirmed the verification state was stuck on the ACS backend.

I’d suggest leaving the existing DKIM2 CNAME in place since it already resolves correctly. Then, check the resource state using Azure CLI (az communication email domain show). The CLI also exposes cancel-verification and initiate-verification, although these commands are currently marked as Preview.

If the state remains Canceling, open an Azure support request and ask them to check/reset the DKIM2 verification state on the ACS Email backend.

As a last resort, deleting and recreating the custom domain can reset the verification state, but it generates new verification records and requires you to configure the DNS records again. That approach resolved a similar confirmed backend-stuck case.

Since yours has been stuck for four days, I’d pursue the backend-state reset before recreating the domain.

Sharing these references with you:

Similar ACS custom-domain verification issue - Microsoft Q&A

Add custom verified email domains - Azure Communication Services

Azure CLI - az communication email domain

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. TP 163.1K Reputation points Volunteer Moderator
    2026-09-08T22:24:49.4533333+00:00

    Hi,

    If you would like to post your custom domain in a comment below I will double-check that your DNS records are correct. You may edit your comment immediately after posting so that your domain is not public.

    Otherwise please follow instructions below to remove and re-Add your custom domain to your Email Communication Service (ECS). In most cases this will fix the issue you are seeing, assuming your DNS records are in fact correct.

    1. Edit the TTL for you SPF TXT record and set it to low value (e.g. 300 or 600 seconds).

    2. Delete the verification TXT record (ms-domain-verification). Leave the DKIM/DKIM2 CNAME records as they are now.

    3. Wait 1 hour for TTL to expire

    4. In Azure portal, navigate to your Email Communication Service -- Settings -- Provision domains, click on context menu (three dots) to the right of your custom domain, select Remove, confirm. Wait for the notification message letting you know that the domain has been removed.

    5. Add your custom domain to your ECS under Provision domains. Create new verification DNS TXT record, only this time give it low TTL like 300 or 600 seconds. This will help speed up troubleshooting.

    6. Periodically click Refresh button to see if verification is finished. Usually you will see the Domain status switch to Verified within about 10-15 minutes and then almost instantly SPF/DKIM/DKIM2 will also switch to Verified. Sometimes you may need to click Configure for SPF or DKIM or DKIM2 and go through the wizard on right, but then when you close that and refresh they will switch to Verified.

    Please reply back with your results, whether positive or negative. I've set up custom domains for ACS many times successfully and can help you get yours working. It can be a bit finicky.

    Thanks.

    -TP

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.