// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
95 guides
| Problem | In short | Tags | |
|---|---|---|---|
| No SPF record on your domain | Your domain does not say which servers may send email for it. Add one TXT record and receivers can tell your real emails from fakes. | Fix it | |
| SPF error: too many DNS lookups (permerror) | SPF allows at most 10 DNS lookups. Above that, the whole record breaks and receivers treat it as invalid. Here is how to slim it down. | Fix it | |
| Several SPF records on one domain | A domain must have only one SPF record. With two or more, SPF breaks for every email. Merge them into a single line. | Fix it | |
| SPF fails: the sending server is not authorized | Your domain has an SPF record, but the server that sent your email is not in it. Find which service sent the email and add it. | Fix it | |
| No DKIM signature on your emails | DKIM adds a digital signature that proves an email really comes from your domain. Turn it on in your email provider and publish its key in DNS. | Fix it | |
| DKIM signature fails (invalid signature or body hash) | Your email is signed, but the signature does not check out. Usually the DNS key is wrong, or something changed the email after it was signed. | Fix it | |
| No DMARC record on your domain | DMARC tells receivers what to do with emails that fail SPF and DKIM, and sends you reports. Gmail and Yahoo require it for bulk senders. Start with a safe monitoring record. | Fix it | |
| DMARC fails: SPF and DKIM do not match your domain | SPF or DKIM can pass and DMARC still fail, because they passed for another domain. Make at least one of them use the same domain as your From address. | Fix it | |
| Move DMARC from p=none to quarantine or reject safely | p=none only watches. To really stop fake emails using your domain, move step by step to quarantine and reject, without blocking your own emails. | Fix it | |
| Your sending IP address is on a blacklist | A blacklist is a public list of IP addresses known for sending spam. Find out if the IP is yours, fix the cause, then ask for removal. | Fix it | |
| Your domain is on a blacklist (Spamhaus DBL, SURBL, URIBL) | Domain blacklists list domain names seen in spam. They follow your domain wherever you send from. Find the cause, clean up, then request removal. | Fix it | |
| No reverse DNS (PTR), or it does not match | Reverse DNS gives a name to your server's IP address. Without it, or if it does not point back, your server looks like an infected home computer. | Fix it | |
| High SpamAssassin spam score | SpamAssassin scores the content of your email. Above 5, it is treated as spam. Learn what raises the score and how to bring it down. | Fix it | |
| No MX record on your domain | MX records tell the world where to deliver email for your domain. Without them, you cannot receive replies, and some receivers distrust your emails. | Fix it | |
| Gmail and Yahoo bulk sender requirements | Since 2024, Gmail and Yahoo require large senders to authenticate their emails, offer one-click unsubscribe and keep spam complaints very low. Here is the checklist. | Fix it | |
| Your emails land in Gmail's spam folder | When Gmail sends your emails to spam, the cause is almost always authentication, reputation or content. Here is how to find which one and fix it. | Fix it | |
| Your emails land in Outlook or Hotmail junk | Outlook.com, Hotmail and Live send many new senders to Junk. Check your setup, then use Microsoft's free sender tools: SNDS, JMRP and the delist portal. | Fix it | |
| Gmail bounce "550 5.7.26": unauthenticated email | Gmail refused your email because it could not confirm it comes from your domain. SPF, DKIM or DMARC is missing or failing. Here is how to fix it. | Fix it | |
| Bounce "550 5.7.1": message rejected or blocked by policy | A 5.7.1 bounce means the receiving server refused your email on purpose. Learn to read bounce messages, find the real reason and fix it. | Fix it | |
| Add a List-Unsubscribe header (one-click unsubscribe) | The List-Unsubscribe header lets Gmail, Yahoo and Outlook show an Unsubscribe button next to your sender name. Bulk senders must offer it in one click. | Fix it | |
| Show your logo in the inbox with BIMI | BIMI displays your brand logo next to your emails in Gmail, Yahoo and Apple Mail. It needs a strict DMARC policy, an SVG logo and often a certificate. | Fix it | |
| Protect your incoming mail with MTA-STS and TLS-RPT | MTA-STS forces other servers to use encryption when they deliver email to your domain. TLS-RPT sends you reports when that fails. Both are optional but recommended. | Fix it | |
| Emails sent without TLS encryption (STARTTLS) | Your server delivered the email in clear text, without encryption. Gmail flags this with a red padlock and expects bulk senders to use TLS. Turn on STARTTLS. | Fix it | |
| Emails from your website or WordPress go to spam | Contact forms, order confirmations and password resets sent by your website often land in spam. Send them through authenticated SMTP or a transactional email service. | Fix it | |
| Warm up a new domain or IP address | A new domain or IP has no reputation yet. Sending a large campaign on day one looks like spam. Start small and increase your volume step by step. | Fix it | |
| Someone sends fake emails with your domain (spoofing) | Scammers can send emails that look like they come from your domain. A DMARC policy at reject tells receivers to refuse them. Monitor first, then enforce. | Fix it | |
| Invalid HELO/EHLO hostname | Your server introduces itself with a name that is not valid, such as localhost or a bare IP. Spam filters distrust this. Give it a real name that matches reverse DNS. | Fix it | |
| Set up SPF, DKIM and DMARC for Google Workspace | A complete checklist to authenticate a domain that sends with Gmail in Google Workspace: one SPF line, DKIM turned on in the Admin console, and a first DMARC record. | Fix it | |
| Set up SPF, DKIM and DMARC for Microsoft 365 | A complete checklist to authenticate a domain that sends with Outlook in Microsoft 365: the SPF include, the two DKIM CNAME records, and a first DMARC record. | Fix it | |
| Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools | Newsletter and transactional tools send with their own domain until you authenticate yours. Add their DKIM records and a custom return path so DMARC passes for your domain. | Fix it | |
| Email forwarding breaks SPF: how DKIM and ARC help | When someone forwards your email automatically, SPF fails because the forwarding server is not yours. A valid DKIM signature, and ARC on the forwarder, keep it trusted. | Fix it | |
| Contact form emails sent "From" the visitor's address | A website form that puts the visitor's email in the From field fails SPF and DMARC. Send from your own address and put the visitor in Reply-To instead. | Fix it | |
| Links that hurt deliverability | URL shorteners, link text that shows one address but points to another, and links to blacklisted domains are classic spam signs. Use plain links to your own domain. | Fix it | |
| Image-only emails and missing plain-text version | An email that is one big image, or that has no plain-text version, looks like spam to filters. Use real text, a few images, and send both HTML and plain text. | Fix it | |
| Attachments blocked or flagged as dangerous | Some file types are refused outright, large files bounce, and unexpected attachments raise spam scores. Send safe formats, keep them small, or share a link instead. | Fix it | |
| High bounce rate: clean your mailing list | Sending to addresses that no longer exist damages your reputation fast. Learn the difference between hard and soft bounces and remove bad addresses after every send. | Fix it | |
| Spam traps and bought email lists | Spam traps are hidden addresses that catch senders with bad lists. Hitting them can blacklist you. Never buy lists, and only email people who asked for it. | Fix it | |
| Emails delayed: greylisting and 4xx temporary errors | Some servers answer "try again later" on purpose. A normal mail server retries and the email arrives a few minutes late. Here is how to tell normal delays from real problems. | Fix it | |
| Use a subdomain for marketing emails | Sending newsletters from a subdomain such as news.yourdomain.com keeps their reputation apart from your everyday business emails. Here is how to set it up. | Fix it | |
| Cold emailing without landing in spam | Prospecting emails are judged harshly by Gmail and Outlook. Protect your main domain, send slowly, write like a person and make opting out easy. | Fix it | |
| Too many people mark your emails as spam | A high spam complaint rate sends all your emails to junk. Learn how to measure complaints, get feedback loops and send only to people who want your emails. | Fix it | |
| Running your own mail server: the deliverability checklist | A self-hosted Postfix server can deliver well, but only if every basic is right: reverse DNS, SPF, DKIM, DMARC, TLS and no open relay. | Fix it | |
| How to set reverse DNS (PTR) at your hosting company | The PTR record of your server IP is set by your hosting company, not in your domain DNS. Here are the general steps at OVH, Hetzner, Scaleway, AWS and DigitalOcean. | Fix it | |
| Your mail server is an open relay | An open relay lets anyone on the internet send email through your server. Spammers find it within hours and your IP ends up blacklisted. | Fix it | |
| Yahoo and AOL "421 4.7.0 [TSS04]" deferrals | Yahoo is temporarily refusing your emails because of their volume or complaints. Slow down, keep retrying, and fix what Yahoo does not like. | Fix it | |
| Emails blocked by Orange, SFR, Free or other French ISPs | French internet providers filter strictly with their own rules. Fix your reverse DNS and authentication, slow down, and use their contact procedures. | Fix it | |
| Missing or wrong Date and Message-ID headers | Every email should carry a correct Date and a unique Message-ID. Without them, spam filters add points and Gmail can refuse the email. | Fix it | |
| DKIM key too short (1024-bit) and how to rotate it | A 1024-bit DKIM key is now considered weak. Create a 2048-bit key under a new selector and switch over without breaking your emails. | Fix it | |
| SPF ends with +all or ?all (too permissive) | An SPF record ending with +all lets the whole internet send as you, and ?all protects nothing. Replace the ending with ~all or -all. | Fix it | |
| How to read DMARC aggregate reports (rua) | DMARC reports are XML files sent by Gmail, Microsoft and others. Learn what each part means and how to spot real problems and spoofing. | Fix it | |
| Gmail shows "via" or "sent on behalf of" next to your name | Recipients see "via another-domain.com" or "on behalf of" because your email is signed or sent with another domain. Sign it with your own domain. | Fix it | |
| Your emails are not received at all: a step-by-step checklist | Your recipients say nothing arrived, not even in spam. Follow these steps in order to find where the email gets lost. | Fix it | |
| Use double opt-in for your newsletter | Ask every new subscriber to confirm their address with one click. Your list stays clean, bounces and complaints drop, and your emails reach the inbox more often. | Fix it | |
| Keep transactional and marketing emails apart | Receipts and password resets should never suffer because a newsletter got complaints. Send each kind of email through its own provider, stream or subdomain. | Fix it | |
| DNS changes not visible yet: propagation and TTL | You added or fixed a record but tests still show the old value. DNS answers are cached for a while; here is how long to wait and how to check the real value. | Fix it | |
| DNS record added at the wrong name | Your record exists, but not where receivers look for it, for example at _dmarc.yourdomain.com.yourdomain.com. Learn how the name field works and fix it. | Fix it | |
| Long DKIM key in DNS: TXT records split into several strings | A 2048-bit DKIM key is too long for one DNS text string. Split it the right way, or the key is broken and every signature fails. | Fix it | |
| Email records lost after moving your domain or DNS host | You moved your domain, website or DNS to a new company and email stopped working. Often the email records were simply not copied. Here is how to restore them. | Fix it | |
| Mailing lists and Google Groups break DMARC | When a discussion list re-sends your email, it changes it and sends it from its own servers, so DMARC can fail. Here is why, and what list owners and senders can do. | Fix it | |
| Shared IP address with a bad reputation | You send from an IP address used by other customers, and one of them is spamming. Your emails pay the price. Here is how to tell and what to ask your provider. | Fix it | |
| A hacked email account is sending spam: what to do | Someone has your password and is sending spam from your mailbox. Lock them out, remove what they left behind, then repair your reputation. | Fix it | |
| Email authentication for subdomains | Sending from news.yourdomain.com or shop.yourdomain.com? SPF and DKIM must be set for each subdomain, and DMARC can give subdomains their own policy with sp=. | Fix it | |
| Protect domains that never send email | Spare domains, old brand names and parked domains can be used by scammers to send fake emails. Three small DNS records tell the world they never send email. | Fix it | |
| Choose a good sender name and From address | The sender name and address are the first things people see. Pick ones that are clear, stable and on your own domain, and readers trust and open your emails. | Fix it | |
| Why "no-reply" addresses hurt your emails | Sending from noreply@ tells readers you do not want to hear from them. It costs you replies, trust and sometimes inbox placement. Use a real address instead. | Fix it | |
| Spammy subject lines and words that trigger filters | Shouting subjects, fake urgency and pushy money words make filters and readers suspicious. Write calm, honest subjects that match the content. | Fix it | |
| Your emails land in Gmail's Promotions tab | The Promotions tab is not spam: Gmail is sorting your marketing emails. Learn when it is normal, and what helps personal and transactional emails stay in Primary. | Fix it | |
| Email too big: Gmail clips messages over 102 KB | When the HTML of an email is larger than about 102 KB, Gmail cuts it and shows "[Message clipped]". Your unsubscribe link and footer can disappear. | Fix it | |
| Garbled characters: fix encoding and charset problems (UTF-8) | Accents turning into "é" or question marks mean the email does not declare its text encoding correctly. Use UTF-8 everywhere and declare it. | Fix it | |
| Return-Path, envelope sender and From: why they must match your domain | An email has two sender addresses: the visible From and a hidden one used for bounces. For DMARC, at least SPF or DKIM must pass for the From domain. | Fix it | |
| SPF ~all or -all: which ending should you choose? | The end of your SPF record tells receivers what to do with unknown servers. Learn the difference between ~all and -all, and when to switch. | Fix it | |
| DMARC tags explained: p, sp, pct, rua, ruf, fo, adkim, aspf | A DMARC record is a short line of tags. Here is what each tag does, which ones you need, and safe values for beginners. | Fix it | |
| Emails to Apple "Hide My Email" addresses (privaterelay.appleid.com) | Users who sign up with Apple can hide their real address behind a relay. Your emails reach them only if you register your sending domain with Apple and authenticate it. | Fix it | |
| Inactive subscribers hurt your reputation: re-engage or remove them | People who never open your emails drag down your reputation and can hide spam traps. Try to win them back once, then stop emailing those who stay silent. | Fix it | |
| Legal footer: unsubscribe link and postal address in marketing emails | Marketing emails need a clear way to unsubscribe and information about who you are. Here are the basics of CAN-SPAM and GDPR, and a simple footer to copy. | Fix it | |
| Gmail warning "Be careful with this message" | Gmail shows a yellow or red banner on your email because it could not confirm you sent it. Fix your authentication and the warning goes away. | Fix it | |
| Outlook shows "?" or "We can't verify the sender" | Outlook replaces your photo with a question mark or says it cannot verify who sent the email. It means authentication failed; here is how to fix it. | Fix it | |
| Bounce "550 5.1.1": the address does not exist | The receiving server says the mailbox does not exist. Check the spelling, remove the address from your lists, and keep your bounce rate low. | Fix it | |
| Bounce "552 5.2.2": the mailbox is full | The recipient has run out of storage space. It is their problem, not yours, but repeated "mailbox full" bounces often mean an abandoned address. | Fix it | |
| "554 5.7.1 Relay access denied" when sending | Your mail server refuses to pass your email on because you are not logged in. Usually a missing SMTP login or the wrong port in your app or printer. | Fix it | |
| Microsoft 365 "550 5.1.8 Access denied, bad outbound sender" | Microsoft 365 has blocked a user from sending because the account sent spam, usually after being hacked. Secure the account, then unblock it. | Fix it | |
| Gmail "421 4.7.28": unusual rate of unsolicited mail | Gmail is slowing down your emails because it sees a sudden spike or spam-like traffic from your IP or domain. Slow down and fix your reputation. | Fix it | |
| Your IP is on the Barracuda blacklist (BRBL) | Barracuda devices block emails from IPs on its reputation list. Find out why you were listed, fix the cause, then ask for removal for free. | Fix it | |
| Microsoft "451 4.7.500 Server busy": temporary deferral | Outlook.com and Hotmail are holding back emails from your IP because they do not know it or trust it yet. Keep volumes low and build reputation. | Fix it | |
| Gmail bounce "550 5.7.25": reverse DNS (PTR) required | Gmail refuses your email because your sending IP has no reverse DNS, or one that does not point back to the IP. Ask your host to set a proper PTR. | Fix it | |
| Several email services on one domain: combine SPF and DKIM correctly | Your mailbox, newsletter tool and online shop all send as your domain. Merge them into one SPF line and give each service its own DKIM key. | Fix it | |
| DKIM with CNAME records: delegated selectors (Microsoft 365, SendGrid…) | Many providers ask for DKIM as CNAME records instead of a TXT key. Here is how they work and the mistakes that break them. | Fix it | |
| SPF flattening: when it helps and what can go wrong | Flattening replaces includes with raw IP addresses to stay under 10 DNS lookups. It works, but a flattened record can silently go out of date. | Fix it | |
| Read email headers yourself: Authentication-Results, Received and DKIM-Signature | Headers are the hidden lines at the top of every email. Learn to find the three that explain why a message passed or failed. | Fix it | |
| Set up Google Postmaster Tools step by step | Google Postmaster Tools is Gmail's free dashboard for senders. Verify your domain once and watch your spam rate and compliance status. | Fix it | |
| Use a custom tracking domain for links in your emails | Newsletter tools rewrite your links through a shared tracking domain. If that domain gets a bad name, your emails suffer. Use your own instead. | Fix it | |
| Shopify, WooCommerce and online store emails: authenticate your domain | Order confirmations and shipping notices must reach the inbox. Make sure your store sends them with your own domain, properly signed. | Fix it | |
| Set up SPF, DKIM and DMARC for Zoho Mail | Using Zoho Mail with your own domain? Add the right SPF include for your Zoho region, turn on DKIM in the Admin Console and publish DMARC. | Fix it | |
| Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts | Your email comes with your web hosting? The steps are the same everywhere: find your host's SPF value, enable DKIM if offered, then add DMARC. | Fix it | |
| Set up a DMARC reporting mailbox (rua) and authorize an external domain | DMARC reports need a mailbox to land in. Choose a dedicated address, and add a _report._dmarc record if it is on another domain. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.