// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
33 guides · tag DNS
| Problem | In short | Tags | |
|---|---|---|---|
| No SPF record on your domain | Your domain does not say which servers may send email for it. Add one TXT record and receivers can tell your real emails from fakes. | Fix it | |
| SPF error: too many DNS lookups (permerror) | SPF allows at most 10 DNS lookups. Above that, the whole record breaks and receivers treat it as invalid. Here is how to slim it down. | Fix it | |
| Several SPF records on one domain | A domain must have only one SPF record. With two or more, SPF breaks for every email. Merge them into a single line. | Fix it | |
| SPF fails: the sending server is not authorized | Your domain has an SPF record, but the server that sent your email is not in it. Find which service sent the email and add it. | Fix it | |
| No DKIM signature on your emails | DKIM adds a digital signature that proves an email really comes from your domain. Turn it on in your email provider and publish its key in DNS. | Fix it | |
| DKIM signature fails (invalid signature or body hash) | Your email is signed, but the signature does not check out. Usually the DNS key is wrong, or something changed the email after it was signed. | Fix it | |
| No DMARC record on your domain | DMARC tells receivers what to do with emails that fail SPF and DKIM, and sends you reports. Gmail and Yahoo require it for bulk senders. Start with a safe monitoring record. | Fix it | |
| Move DMARC from p=none to quarantine or reject safely | p=none only watches. To really stop fake emails using your domain, move step by step to quarantine and reject, without blocking your own emails. | Fix it | |
| No reverse DNS (PTR), or it does not match | Reverse DNS gives a name to your server's IP address. Without it, or if it does not point back, your server looks like an infected home computer. | Fix it | |
| No MX record on your domain | MX records tell the world where to deliver email for your domain. Without them, you cannot receive replies, and some receivers distrust your emails. | Fix it | |
| Show your logo in the inbox with BIMI | BIMI displays your brand logo next to your emails in Gmail, Yahoo and Apple Mail. It needs a strict DMARC policy, an SVG logo and often a certificate. | Fix it | |
| Protect your incoming mail with MTA-STS and TLS-RPT | MTA-STS forces other servers to use encryption when they deliver email to your domain. TLS-RPT sends you reports when that fails. Both are optional but recommended. | Fix it | |
| Invalid HELO/EHLO hostname | Your server introduces itself with a name that is not valid, such as localhost or a bare IP. Spam filters distrust this. Give it a real name that matches reverse DNS. | Fix it | |
| Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools | Newsletter and transactional tools send with their own domain until you authenticate yours. Add their DKIM records and a custom return path so DMARC passes for your domain. | Fix it | |
| Use a subdomain for marketing emails | Sending newsletters from a subdomain such as news.yourdomain.com keeps their reputation apart from your everyday business emails. Here is how to set it up. | Fix it | |
| How to set reverse DNS (PTR) at your hosting company | The PTR record of your server IP is set by your hosting company, not in your domain DNS. Here are the general steps at OVH, Hetzner, Scaleway, AWS and DigitalOcean. | Fix it | |
| DKIM key too short (1024-bit) and how to rotate it | A 1024-bit DKIM key is now considered weak. Create a 2048-bit key under a new selector and switch over without breaking your emails. | Fix it | |
| SPF ends with +all or ?all (too permissive) | An SPF record ending with +all lets the whole internet send as you, and ?all protects nothing. Replace the ending with ~all or -all. | Fix it | |
| Your emails are not received at all: a step-by-step checklist | Your recipients say nothing arrived, not even in spam. Follow these steps in order to find where the email gets lost. | Fix it | |
| DNS changes not visible yet: propagation and TTL | You added or fixed a record but tests still show the old value. DNS answers are cached for a while; here is how long to wait and how to check the real value. | Fix it | |
| DNS record added at the wrong name | Your record exists, but not where receivers look for it, for example at _dmarc.yourdomain.com.yourdomain.com. Learn how the name field works and fix it. | Fix it | |
| Long DKIM key in DNS: TXT records split into several strings | A 2048-bit DKIM key is too long for one DNS text string. Split it the right way, or the key is broken and every signature fails. | Fix it | |
| Email records lost after moving your domain or DNS host | You moved your domain, website or DNS to a new company and email stopped working. Often the email records were simply not copied. Here is how to restore them. | Fix it | |
| Email authentication for subdomains | Sending from news.yourdomain.com or shop.yourdomain.com? SPF and DKIM must be set for each subdomain, and DMARC can give subdomains their own policy with sp=. | Fix it | |
| SPF ~all or -all: which ending should you choose? | The end of your SPF record tells receivers what to do with unknown servers. Learn the difference between ~all and -all, and when to switch. | Fix it | |
| DMARC tags explained: p, sp, pct, rua, ruf, fo, adkim, aspf | A DMARC record is a short line of tags. Here is what each tag does, which ones you need, and safe values for beginners. | Fix it | |
| Gmail bounce "550 5.7.25": reverse DNS (PTR) required | Gmail refuses your email because your sending IP has no reverse DNS, or one that does not point back to the IP. Ask your host to set a proper PTR. | Fix it | |
| DKIM with CNAME records: delegated selectors (Microsoft 365, SendGrid…) | Many providers ask for DKIM as CNAME records instead of a TXT key. Here is how they work and the mistakes that break them. | Fix it | |
| SPF flattening: when it helps and what can go wrong | Flattening replaces includes with raw IP addresses to stay under 10 DNS lookups. It works, but a flattened record can silently go out of date. | Fix it | |
| Set up Google Postmaster Tools step by step | Google Postmaster Tools is Gmail's free dashboard for senders. Verify your domain once and watch your spam rate and compliance status. | Fix it | |
| Use a custom tracking domain for links in your emails | Newsletter tools rewrite your links through a shared tracking domain. If that domain gets a bad name, your emails suffer. Use your own instead. | Fix it | |
| Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts | Your email comes with your web hosting? The steps are the same everywhere: find your host's SPF value, enable DKIM if offered, then add DMARC. | Fix it | |
| Set up a DMARC reporting mailbox (rua) and authorize an external domain | DMARC reports need a mailbox to land in. Choose a dedicated address, and add a _report._dmarc record if it is on another domain. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.