Why is my Intercom subdomain authentication failing even after DNS records are added?
Summary
What email marketers say11Marketer opinions
Email marketer from Email Deliverability Blog suggests that the Intercom authentication process itself might be experiencing temporary issues. Try waiting a few hours and then re-attempting the verification process within Intercom.
Email marketer from Webmaster Forum says that excessively high TTL (Time To Live) values on DNS records can delay propagation. Lowering the TTL value before adding the Intercom records can speed up the verification process.
Marketer from Email Geeks says that the issue could be on the MTA side, or Intercom might need to provide a new key. Suggests asking for help if Intercom's system isn't sensing the authentication and recommends trying to delete and re-add the records or clicking "Verify authentication" again.
Email marketer from Reddit r/emailmarketing suggests double-checking the CNAME record format. Ensure there are no trailing dots or extra characters in the hostname or value fields of the DNS record, as this can cause authentication failures.
Email marketer from StackExchange explains that if the subdomain is behind a CDN (Content Delivery Network), the CDN might be interfering with the DNS verification process. Bypassing or temporarily disabling the CDN for that subdomain could help.
Marketer from Email Geeks suggests the issue could be that the web browser isn't refreshing correctly or the session is the problem, recommending logging out and trying again to see if it refreshes on a new login.
Marketer from Email Geeks suggests that the primary domain and subdomain might be using different DNS servers and asks if it's possible the DNS records haven't propagated yet.
Marketer from Email Geeks recommends opening a support request with Intercom and advises against using DMARC as a solution, stating that DMARC is rarely the solution.
Email marketer from EmailGeeks Forum mentions that conflicting DNS records can cause authentication problems. Check for any other existing TXT or CNAME records that might conflict with the Intercom authentication records.
Email marketer from Reddit r/Intercom recommends contacting Intercom support, there may be an issue on Intercom's end that requires manual intervention, and provides details on how to contact support and what information to provide.
Email marketer from Sendgrid's Documentation suggests ensuring that the subdomain isn't blocked or blacklisted by any security policies. This can prevent proper authentication even if the DNS records are correct.
What the experts say2Expert opinions
Expert from Word to the Wise suggests checking for CAA (Certificate Authority Authorization) records. Although primarily for SSL certificates, misconfigured CAA records can sometimes interfere with DNS lookups in unexpected ways, potentially impacting subdomain authentication.
Expert from Word to the Wise explains that it is important to monitor the DNS records and their propagation using tools like DNS Spy to ensure the changes are correctly applied and visible across different locations. This is because DNS issues can often be intermittent and location-specific.
What the documentation says6Technical articles
Documentation from Cloudflare Support highlights that some DNS providers might not fully support certain record types or have specific requirements. Ensure that the DNS provider fully supports CNAME records and that there are no limitations affecting the authentication process.
Documentation from Intercom Help Center emphasizes the importance of copying the DNS record values exactly as provided by Intercom. Even a minor typo can prevent successful authentication. It is important to confirm the records were copied correctly.
Documentation from Intercom Help Center explains that DNS changes can take up to 48 hours to propagate fully. Even if the DNS records are added correctly, Intercom might not immediately recognize them until propagation is complete.
Documentation from MXToolbox explains using tools such as MXToolbox and similar sites to check if the DNS records are resolving correctly from multiple locations. This can help determine if the issue is related to local DNS caching.
Documentation from Intercom Help Center mentions that the Intercom user account used to configure the authentication must have the necessary permissions to modify settings related to email sending and domain authentication.
Documentation from Whatsmydns.net says that you should use online tools to check DNS propagation from multiple geographic locations to identify if the DNS records have propagated worldwide or only in certain regions.