// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
16 guides · tag Security
| Problem | In short | Tags | |
|---|---|---|---|
| Move DMARC from p=none to quarantine or reject safely | p=none only watches. To really stop fake emails using your domain, move step by step to quarantine and reject, without blocking your own emails. | Fix it | |
| Your sending IP address is on a blacklist | A blacklist is a public list of IP addresses known for sending spam. Find out if the IP is yours, fix the cause, then ask for removal. | Fix it | |
| Your domain is on a blacklist (Spamhaus DBL, SURBL, URIBL) | Domain blacklists list domain names seen in spam. They follow your domain wherever you send from. Find the cause, clean up, then request removal. | Fix it | |
| Protect your incoming mail with MTA-STS and TLS-RPT | MTA-STS forces other servers to use encryption when they deliver email to your domain. TLS-RPT sends you reports when that fails. Both are optional but recommended. | Fix it | |
| Emails sent without TLS encryption (STARTTLS) | Your server delivered the email in clear text, without encryption. Gmail flags this with a red padlock and expects bulk senders to use TLS. Turn on STARTTLS. | Fix it | |
| Someone sends fake emails with your domain (spoofing) | Scammers can send emails that look like they come from your domain. A DMARC policy at reject tells receivers to refuse them. Monitor first, then enforce. | Fix it | |
| Attachments blocked or flagged as dangerous | Some file types are refused outright, large files bounce, and unexpected attachments raise spam scores. Send safe formats, keep them small, or share a link instead. | Fix it | |
| Running your own mail server: the deliverability checklist | A self-hosted Postfix server can deliver well, but only if every basic is right: reverse DNS, SPF, DKIM, DMARC, TLS and no open relay. | Fix it | |
| Your mail server is an open relay | An open relay lets anyone on the internet send email through your server. Spammers find it within hours and your IP ends up blacklisted. | Fix it | |
| DKIM key too short (1024-bit) and how to rotate it | A 1024-bit DKIM key is now considered weak. Create a 2048-bit key under a new selector and switch over without breaking your emails. | Fix it | |
| SPF ends with +all or ?all (too permissive) | An SPF record ending with +all lets the whole internet send as you, and ?all protects nothing. Replace the ending with ~all or -all. | Fix it | |
| A hacked email account is sending spam: what to do | Someone has your password and is sending spam from your mailbox. Lock them out, remove what they left behind, then repair your reputation. | Fix it | |
| Protect domains that never send email | Spare domains, old brand names and parked domains can be used by scammers to send fake emails. Three small DNS records tell the world they never send email. | Fix it | |
| Gmail warning "Be careful with this message" | Gmail shows a yellow or red banner on your email because it could not confirm you sent it. Fix your authentication and the warning goes away. | Fix it | |
| "554 5.7.1 Relay access denied" when sending | Your mail server refuses to pass your email on because you are not logged in. Usually a missing SMTP login or the wrong port in your app or printer. | Fix it | |
| Microsoft 365 "550 5.1.8 Access denied, bad outbound sender" | Microsoft 365 has blocked a user from sending because the account sent spam, usually after being hacked. Secure the account, then unblock it. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.