// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
28 guides · tag DMARC
| Problem | In short | Tags | |
|---|---|---|---|
| No DMARC record on your domain | DMARC tells receivers what to do with emails that fail SPF and DKIM, and sends you reports. Gmail and Yahoo require it for bulk senders. Start with a safe monitoring record. | Fix it | |
| DMARC fails: SPF and DKIM do not match your domain | SPF or DKIM can pass and DMARC still fail, because they passed for another domain. Make at least one of them use the same domain as your From address. | Fix it | |
| Move DMARC from p=none to quarantine or reject safely | p=none only watches. To really stop fake emails using your domain, move step by step to quarantine and reject, without blocking your own emails. | Fix it | |
| Gmail and Yahoo bulk sender requirements | Since 2024, Gmail and Yahoo require large senders to authenticate their emails, offer one-click unsubscribe and keep spam complaints very low. Here is the checklist. | Fix it | |
| Gmail bounce "550 5.7.26": unauthenticated email | Gmail refused your email because it could not confirm it comes from your domain. SPF, DKIM or DMARC is missing or failing. Here is how to fix it. | Fix it | |
| Show your logo in the inbox with BIMI | BIMI displays your brand logo next to your emails in Gmail, Yahoo and Apple Mail. It needs a strict DMARC policy, an SVG logo and often a certificate. | Fix it | |
| Someone sends fake emails with your domain (spoofing) | Scammers can send emails that look like they come from your domain. A DMARC policy at reject tells receivers to refuse them. Monitor first, then enforce. | Fix it | |
| Set up SPF, DKIM and DMARC for Google Workspace | A complete checklist to authenticate a domain that sends with Gmail in Google Workspace: one SPF line, DKIM turned on in the Admin console, and a first DMARC record. | Fix it | |
| Set up SPF, DKIM and DMARC for Microsoft 365 | A complete checklist to authenticate a domain that sends with Outlook in Microsoft 365: the SPF include, the two DKIM CNAME records, and a first DMARC record. | Fix it | |
| Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools | Newsletter and transactional tools send with their own domain until you authenticate yours. Add their DKIM records and a custom return path so DMARC passes for your domain. | Fix it | |
| Email forwarding breaks SPF: how DKIM and ARC help | When someone forwards your email automatically, SPF fails because the forwarding server is not yours. A valid DKIM signature, and ARC on the forwarder, keep it trusted. | Fix it | |
| Contact form emails sent "From" the visitor's address | A website form that puts the visitor's email in the From field fails SPF and DMARC. Send from your own address and put the visitor in Reply-To instead. | Fix it | |
| How to read DMARC aggregate reports (rua) | DMARC reports are XML files sent by Gmail, Microsoft and others. Learn what each part means and how to spot real problems and spoofing. | Fix it | |
| Gmail shows "via" or "sent on behalf of" next to your name | Recipients see "via another-domain.com" or "on behalf of" because your email is signed or sent with another domain. Sign it with your own domain. | Fix it | |
| DNS record added at the wrong name | Your record exists, but not where receivers look for it, for example at _dmarc.yourdomain.com.yourdomain.com. Learn how the name field works and fix it. | Fix it | |
| Mailing lists and Google Groups break DMARC | When a discussion list re-sends your email, it changes it and sends it from its own servers, so DMARC can fail. Here is why, and what list owners and senders can do. | Fix it | |
| Email authentication for subdomains | Sending from news.yourdomain.com or shop.yourdomain.com? SPF and DKIM must be set for each subdomain, and DMARC can give subdomains their own policy with sp=. | Fix it | |
| Protect domains that never send email | Spare domains, old brand names and parked domains can be used by scammers to send fake emails. Three small DNS records tell the world they never send email. | Fix it | |
| Return-Path, envelope sender and From: why they must match your domain | An email has two sender addresses: the visible From and a hidden one used for bounces. For DMARC, at least SPF or DKIM must pass for the From domain. | Fix it | |
| DMARC tags explained: p, sp, pct, rua, ruf, fo, adkim, aspf | A DMARC record is a short line of tags. Here is what each tag does, which ones you need, and safe values for beginners. | Fix it | |
| Gmail warning "Be careful with this message" | Gmail shows a yellow or red banner on your email because it could not confirm you sent it. Fix your authentication and the warning goes away. | Fix it | |
| Outlook shows "?" or "We can't verify the sender" | Outlook replaces your photo with a question mark or says it cannot verify who sent the email. It means authentication failed; here is how to fix it. | Fix it | |
| Several email services on one domain: combine SPF and DKIM correctly | Your mailbox, newsletter tool and online shop all send as your domain. Merge them into one SPF line and give each service its own DKIM key. | Fix it | |
| Read email headers yourself: Authentication-Results, Received and DKIM-Signature | Headers are the hidden lines at the top of every email. Learn to find the three that explain why a message passed or failed. | Fix it | |
| Shopify, WooCommerce and online store emails: authenticate your domain | Order confirmations and shipping notices must reach the inbox. Make sure your store sends them with your own domain, properly signed. | Fix it | |
| Set up SPF, DKIM and DMARC for Zoho Mail | Using Zoho Mail with your own domain? Add the right SPF include for your Zoho region, turn on DKIM in the Admin Console and publish DMARC. | Fix it | |
| Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts | Your email comes with your web hosting? The steps are the same everywhere: find your host's SPF value, enable DKIM if offered, then add DMARC. | Fix it | |
| Set up a DMARC reporting mailbox (rua) and authorize an external domain | DMARC reports need a mailbox to land in. Choose a dedicated address, and add a _report._dmarc record if it is on another domain. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.