// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
26 guides · tag DKIM
| Problem | In short | Tags | |
|---|---|---|---|
| No DKIM signature on your emails | DKIM adds a digital signature that proves an email really comes from your domain. Turn it on in your email provider and publish its key in DNS. | Fix it | |
| DKIM signature fails (invalid signature or body hash) | Your email is signed, but the signature does not check out. Usually the DNS key is wrong, or something changed the email after it was signed. | Fix it | |
| DMARC fails: SPF and DKIM do not match your domain | SPF or DKIM can pass and DMARC still fail, because they passed for another domain. Make at least one of them use the same domain as your From address. | Fix it | |
| Emails from your website or WordPress go to spam | Contact forms, order confirmations and password resets sent by your website often land in spam. Send them through authenticated SMTP or a transactional email service. | Fix it | |
| Someone sends fake emails with your domain (spoofing) | Scammers can send emails that look like they come from your domain. A DMARC policy at reject tells receivers to refuse them. Monitor first, then enforce. | Fix it | |
| Set up SPF, DKIM and DMARC for Google Workspace | A complete checklist to authenticate a domain that sends with Gmail in Google Workspace: one SPF line, DKIM turned on in the Admin console, and a first DMARC record. | Fix it | |
| Set up SPF, DKIM and DMARC for Microsoft 365 | A complete checklist to authenticate a domain that sends with Outlook in Microsoft 365: the SPF include, the two DKIM CNAME records, and a first DMARC record. | Fix it | |
| Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools | Newsletter and transactional tools send with their own domain until you authenticate yours. Add their DKIM records and a custom return path so DMARC passes for your domain. | Fix it | |
| Email forwarding breaks SPF: how DKIM and ARC help | When someone forwards your email automatically, SPF fails because the forwarding server is not yours. A valid DKIM signature, and ARC on the forwarder, keep it trusted. | Fix it | |
| Running your own mail server: the deliverability checklist | A self-hosted Postfix server can deliver well, but only if every basic is right: reverse DNS, SPF, DKIM, DMARC, TLS and no open relay. | Fix it | |
| DKIM key too short (1024-bit) and how to rotate it | A 1024-bit DKIM key is now considered weak. Create a 2048-bit key under a new selector and switch over without breaking your emails. | Fix it | |
| How to read DMARC aggregate reports (rua) | DMARC reports are XML files sent by Gmail, Microsoft and others. Learn what each part means and how to spot real problems and spoofing. | Fix it | |
| Gmail shows "via" or "sent on behalf of" next to your name | Recipients see "via another-domain.com" or "on behalf of" because your email is signed or sent with another domain. Sign it with your own domain. | Fix it | |
| Keep transactional and marketing emails apart | Receipts and password resets should never suffer because a newsletter got complaints. Send each kind of email through its own provider, stream or subdomain. | Fix it | |
| DNS record added at the wrong name | Your record exists, but not where receivers look for it, for example at _dmarc.yourdomain.com.yourdomain.com. Learn how the name field works and fix it. | Fix it | |
| Long DKIM key in DNS: TXT records split into several strings | A 2048-bit DKIM key is too long for one DNS text string. Split it the right way, or the key is broken and every signature fails. | Fix it | |
| Email records lost after moving your domain or DNS host | You moved your domain, website or DNS to a new company and email stopped working. Often the email records were simply not copied. Here is how to restore them. | Fix it | |
| Email authentication for subdomains | Sending from news.yourdomain.com or shop.yourdomain.com? SPF and DKIM must be set for each subdomain, and DMARC can give subdomains their own policy with sp=. | Fix it | |
| Emails to Apple "Hide My Email" addresses (privaterelay.appleid.com) | Users who sign up with Apple can hide their real address behind a relay. Your emails reach them only if you register your sending domain with Apple and authenticate it. | Fix it | |
| Outlook shows "?" or "We can't verify the sender" | Outlook replaces your photo with a question mark or says it cannot verify who sent the email. It means authentication failed; here is how to fix it. | Fix it | |
| Several email services on one domain: combine SPF and DKIM correctly | Your mailbox, newsletter tool and online shop all send as your domain. Merge them into one SPF line and give each service its own DKIM key. | Fix it | |
| DKIM with CNAME records: delegated selectors (Microsoft 365, SendGrid…) | Many providers ask for DKIM as CNAME records instead of a TXT key. Here is how they work and the mistakes that break them. | Fix it | |
| Read email headers yourself: Authentication-Results, Received and DKIM-Signature | Headers are the hidden lines at the top of every email. Learn to find the three that explain why a message passed or failed. | Fix it | |
| Shopify, WooCommerce and online store emails: authenticate your domain | Order confirmations and shipping notices must reach the inbox. Make sure your store sends them with your own domain, properly signed. | Fix it | |
| Set up SPF, DKIM and DMARC for Zoho Mail | Using Zoho Mail with your own domain? Add the right SPF include for your Zoho region, turn on DKIM in the Admin Console and publish DMARC. | Fix it | |
| Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts | Your email comes with your web hosting? The steps are the same everywhere: find your host's SPF value, enable DKIM if offered, then add DMARC. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.