Alibaba Cloud standalone global account How to configure Alibaba Cloud DNS records for email domain verification

If you are trying to verify a domain for email sending, the real question is usually not “what is DNS?” but “which record should I add, where do I find it in Alibaba Cloud, and why did verification still fail after I added it?”

In practice, most users hit problems in four places: the domain is in the wrong account, the DNS zone is not the authoritative one, the TXT record is entered with the wrong format, or the cloud account itself is not fully activated because KYC, payment, or risk control checks are still pending.

This article focuses on the operational side: how to get the record added correctly, what can block verification, and what to check before blaming the email provider.

What users usually want to achieve

Most people searching this topic are trying to complete one of these tasks:

• Verify a domain for an email service like Alibaba Cloud DirectMail, Microsoft 365, Google Workspace, SendGrid, Mailgun, or similar.
• Prove domain ownership before enabling SMTP sending.
• Set SPF, DKIM, or DMARC-related DNS records for mail authentication.
• Fix a verification request that keeps showing “pending” or “failed.”
• Understand whether they need a paid Alibaba Cloud account before DNS verification can work.

In almost every case, the record itself is simple. The hard part is the account state and DNS authority.

Before you touch DNS: confirm the Alibaba Cloud account is usable

I have seen users spend hours adjusting TXT values only to discover the Alibaba Cloud account was still restricted. This is common when the account is newly registered, has not completed real-name verification, or payment methods were not accepted by risk control.

1) Account registration and activation

Alibaba Cloud International account creation is usually straightforward, but registration success does not mean the account is ready for all operations.

Common blockers:

• Email or phone verification not completed
• Organization information missing
• KYC not submitted or still under review
• Account flagged for additional compliance checks
• Alibaba Cloud standalone global account Some services are visible but cannot be used until billing is activated

If your goal is only DNS record management for domain verification, basic account access is often enough. But if you are also buying DirectMail, OSS, ECS, or other services, the account may need full identity and billing activation.

Alibaba Cloud standalone global account 2) KYC and enterprise verification

For individuals, identity verification normally requires a passport or local ID depending on the region. For companies, Alibaba Cloud may ask for business registration documents, authorized contact details, and sometimes supporting evidence if the business name and payment profile do not match.

Typical failure reasons:

• Company name in the application does not exactly match the registration document
• Uploaded document is cropped or unreadable
• Billing country and document country appear inconsistent
• Authorized signatory information is missing
• Risk control requests more proof of business activity

If verification is delayed, DNS verification itself may still be technically possible if the DNS zone is already hosted elsewhere. But many users cannot proceed smoothly because the account cannot purchase or renew the email service they need.

3) Payment methods and account funding

From a practical perspective, the payment method can matter more than the DNS record.

Common payment options vary by region and account type, but in real operations the most relevant differences are:

• Credit/debit cards: fastest to activate, but also more likely to trigger risk checks if billing country, BIN country, and account region do not align.
• Bank transfer: useful for enterprise accounts and larger renewals, but activation is slower and the funds may not be immediate.
• Third-party payment wallets: availability depends on region; sometimes accepted for registration but not ideal for long-term renewal continuity.
• Prepaid account balance: convenient for renewals, but you still need a working payment profile to top it up.

For email domain verification, the record can be added even without a funded balance if you only use the DNS service. But if you are using Alibaba Cloud products tied to the domain, failures often appear later at renewal time, which is when users discover the account had never been fully activated.

Where the DNS record actually needs to be added

This is the part where most mistakes happen.

If your domain is registered with Alibaba Cloud but DNS is hosted somewhere else, adding the record in Alibaba Cloud Console will not help. The email provider checks the authoritative DNS, not the registrar interface.

You must add the record in the DNS service that is actually serving the domain:

• Alibaba Cloud DNS if the nameservers point there
• Cloudflare if Cloudflare nameservers are in use
• Route 53, GoDaddy DNS, DNSPod, or another provider if they are authoritative

Quick check: look at the domain’s NS records. If the nameservers do not point to Alibaba Cloud DNS, changing records in Alibaba Cloud DNS Console will not pass verification.

How to add the verification record in Alibaba Cloud DNS Console

The exact value depends on the email service, but the workflow is usually the same.

Step-by-step process

1. Log in to the Alibaba Cloud Console.
2. Open DNS or Alibaba Cloud DNS.
3. Select the domain from the zone list.
4. Click Add Record.
5. Enter the record type provided by your email platform, usually TXT.
6. Fill in the host/name field exactly as instructed.
7. Paste the value exactly as provided, without extra spaces or line breaks.
8. Set TTL to a normal value such as 600 or 900 seconds if you want slightly faster propagation.
9. Alibaba Cloud standalone global account Save the record.
10. Alibaba Cloud standalone global account Wait for DNS propagation, then return to the email platform and click verify.

Common record formats

What to enter in the host/name field

Alibaba Cloud DNS usually lets you set a record under a specific host label. The mistake I see most often is users entering the full domain when the provider expects only the subdomain portion.

Examples:

• If the provider asks for _amazonses.example.com as a full name, Alibaba Cloud may want the host field as _amazonses with the domain already implied by the zone.
• Alibaba Cloud standalone global account If the provider asks for @ or root domain verification, Alibaba Cloud may use a blank or default host depending on the UI.
• For DKIM, the host often looks like selector1._domainkey.

Do not guess. Copy the exact host value from the email service instructions and map it carefully to the Alibaba Cloud DNS interface.

Why verification fails even when the record looks correct

This is where real operational troubleshooting matters.

1) Propagation delay

Some providers verify within minutes, but in practice DNS propagation can take longer. If the TTL is high or DNS caching is aggressive, it may take 10 to 60 minutes, sometimes longer.

If you just added the record, wait before rechecking. Repeated manual verify clicks do not speed up propagation.

2) Wrong authoritative DNS

You edited Alibaba Cloud DNS, but the domain is actually delegated to another provider. This is the most frequent failure case.

Check nameservers first, then edit the correct DNS platform.

3) Extra quotes, spaces, or formatting errors

Some email providers show TXT values inside quotation marks. In many DNS consoles, you should enter the raw value only. Adding the quotes can cause verification failure.

Also check for:

• Leading or trailing spaces
• Broken line wrapping
• Unicode characters copied from documents
• Incorrect punctuation in host names

4) Conflicting records

SPF is a common example. If you already have one SPF TXT record and you add another separately, some receivers will treat the domain as misconfigured.

For SPF, merge authorized sources into a single TXT record.

5) DNSSEC or caching edge cases

Less common, but I have seen cases where DNSSEC misconfiguration or stale resolver caches caused the verification system to fail even though public DNS looked correct. In those cases, recheck from multiple DNS lookup tools and test from different resolvers.

6) Account-level compliance or service limitation

Sometimes verification is not the issue at all. The account may be under review, the service may be restricted by region, or billing may be incomplete. Then the email platform shows a generic “verification pending” message even though the DNS is fine.

How to troubleshoot from the Alibaba Cloud side

Use this sequence when a record does not verify:

1. Confirm the domain is delegated to Alibaba Cloud DNS.
2. Open the DNS zone and check that the record exists.
3. Copy the record name and value exactly as entered.
4. Test public resolution using a DNS lookup tool.
5. Compare the public result with the email provider’s required value.
6. Check whether the Alibaba Cloud account has any warnings, unpaid invoices, or compliance notices.
7. If the account is new, verify that KYC is complete and not still pending review.

If you are managing a company domain, also confirm who controls the domain registrar account. Many verification delays are caused by internal ownership confusion rather than technical issues.

Cost considerations: DNS verification itself is cheap, but the surrounding setup may not be

Users often assume email domain verification costs nothing beyond a TXT record. That is only partly true.

What usually costs money

• Domain registration renewal
• Alibaba Cloud standalone global account Paid DNS hosting, if your current provider charges for advanced zones
• Email service subscription
• SMTP or transactional email sending fees
• Cloud account funding for services tied to the domain

Alibaba Cloud-specific cost reality

DNS record management itself is generally low cost relative to the rest of the stack, but account maintenance matters. If you plan to keep the domain in Alibaba Cloud and use it for email services, make sure the payment method remains valid. Card expiry or failed renewals can interrupt service later, even if verification has already succeeded.

Alibaba Cloud standalone global account Simple cost comparison from a practical perspective

Account usage restrictions that affect email verification workflows

Alibaba Cloud accounts can operate normally in one area and still have restrictions in another. This is important when the domain verification process is tied to broader service usage.

Alibaba Cloud standalone global account Examples of restrictions users encounter:

• New account cannot immediately purchase certain services
• International billing profile limited until KYC is accepted
• High-risk payment methods trigger manual review
• Suspicious login or IP patterns cause temporary freezes
• Alibaba Cloud standalone global account Region mismatch between business profile and selected services

If you are registering the account mainly to manage DNS and email authentication, keep the first setup simple: use consistent identity details, a stable payment method, and one region choice. Frequent changes can raise review flags.

Real-world scenarios

Scenario 1: Domain is in Alibaba Cloud, but verification keeps failing

A user registers example.com with Alibaba Cloud and adds a TXT verification record in the Alibaba Cloud DNS console. The email platform still says “not found.”

Root cause: the domain’s nameservers were still pointing to the previous registrar.

Fix: update the nameservers to Alibaba Cloud DNS or add the record at the actual authoritative provider.

Scenario 2: Enterprise account is under review

A company tries to verify a domain for sending invoices and notices that the account is not fully activated because business documents are pending review.

Root cause: KYC documents were incomplete and billing information did not match the company registration.

Fix: resubmit the business license, authorized signer details, and ensure the billing profile matches the legal entity.

Scenario 3: SPF record added twice

An operations team adds a new SPF TXT record without checking the existing one. Mail delivery gets worse and the sender verification process becomes unstable.

Root cause: multiple SPF records.

Fix: merge all authorized senders into one SPF record and remove the duplicates.

Frequently asked questions

Do I need a paid Alibaba Cloud account just to add a verification TXT record?

Usually, no. But if your domain or DNS zone is tied to an account that has not completed registration, KYC, or billing activation, other actions may be blocked. If the domain is hosted elsewhere, you do not need Alibaba Cloud DNS at all.

Can I verify a domain if I bought it somewhere else?

Yes. Domain registration and DNS hosting are separate. You only need access to the authoritative DNS provider.

How long does DNS verification usually take?

Often 5 to 30 minutes. In some cases it can take longer depending on TTL, caching, and the email provider’s validation cycle.

Why does the record show correctly in Alibaba Cloud but the email platform still cannot detect it?

Most likely the domain is not using Alibaba Cloud DNS as the authoritative nameserver, or the email service is checking a slightly different host/value than what was added.

Should I use TXT or CNAME for verification?

Use exactly what the email provider requests. Domain ownership verification is often TXT, while DKIM can be TXT or CNAME depending on the service.

What payment method is safest for Alibaba Cloud account activation?

A card that matches the account region and billing details is usually the fastest for activation. For enterprise renewals, bank transfer may be more stable, but it is slower to set up.

Why did Alibaba Cloud ask for more documents after I already registered?

That usually means risk control or compliance review was triggered. Common reasons include region mismatch, unusual payment patterns, or company information that does not fully align.

Can I keep email verification working if I stop renewing other Alibaba Cloud services?

Yes, as long as the DNS service remains active and the authoritative records are maintained elsewhere or on Alibaba Cloud DNS. But if the DNS hosting itself is part of a paid Alibaba Cloud service, renew it on time.

Practical checklist before you click “Verify”

• Confirm the domain’s authoritative nameservers
• Make sure the DNS record is added in the correct provider
• Use the exact host/name from the email platform
• Copy the TXT or CNAME value exactly, without extra characters
• Check for duplicate SPF records
• Alibaba Cloud standalone global account Wait for DNS propagation before retrying
• Confirm the Alibaba Cloud account is not blocked by KYC or payment review
• Ensure the domain renewal and billing setup will not expire during rollout

What I recommend in real deployments

If you are setting this up for a business email workflow, do not treat DNS verification as a one-time checkbox. Build it as part of account governance:

• Keep the domain in a corporate-controlled registrar account
• Document who can change DNS
• Use company payment methods instead of personal cards when possible
• Complete KYC early, not after the email platform goes live
• Store SPF, DKIM, and DMARC values in an internal operations record

This prevents the common situation where marketing, IT, and finance each think someone else owns the domain, and verification gets delayed for days.

Bottom line

To configure Alibaba Cloud DNS records for email domain verification, the key is not just adding a TXT record. You must add it in the authoritative DNS zone, enter the host and value exactly as required, and make sure the Alibaba Cloud account itself is fully usable if your workflow depends on it.

In real operations, failures are usually caused by one of these: wrong DNS provider, incorrect host format, duplicate SPF setup, incomplete KYC, payment review issues, or renewals that were never planned for. If you check those first, verification usually becomes a simple five-minute task instead of a support-ticket cycle.