Email deliverability guides
In-depth guides to diagnosing and fixing email delivery problems across Gmail, Outlook, and the authentication stack.
Gmail
- Why Gmail rejects emails from your domainDiagnose Gmail rejections via SPF, DKIM, DMARC, alignment, blacklist, and TLS signals.
- Gmail 5.7.26 error: why Gmail says your email is unauthenticatedGmail 5.7.26 usually points to missing or failing sender authentication. Check SPF, DKIM, DMARC, and alignment before changing content or resending the same campaign.
- SPF, DKIM, and DMARC pass but Gmail sends email to spamPassing SPF, DKIM, and DMARC is necessary, but Gmail can still filter messages based on reputation, volume, content, engagement, and provider-specific signals.
- New domain emails going to Gmail spam: what is technical and what is reputationNew domains can pass SPF, DKIM, and DMARC and still land in Gmail spam. Check authentication, alignment, PTR/TLS basics, sending history, volume changes, and Postmaster Tools limits.
- Emails from my domain go to Gmail spam: what to check firstSpam-folder placement on Gmail can happen even with valid SPF, DKIM, and DMARC. Diagnose the visible From domain, sending path, recent changes, and reputation signals.
- Gmail Postmaster Tools vs public checks: what each signal meansPostmaster Tools and public DNS checks measure different layers. Public checks confirm SPF, DKIM, DMARC, PTR, and TLS posture; Postmaster Tools reflects what Gmail itself sees from your domain volume.
- Gmail 5.7.27 error: how to fix SPF failures Gmail rejects onGmail 5.7.27 is an SPF-specific authentication failure. Identify the envelope (return-path) domain, verify the real sending IP is authorized, and check for lookup-limit and syntax problems before resending.
- Gmail 5.7.30 error: how to fix DKIM failures Gmail rejects onGmail 5.7.30 is a DKIM-specific authentication failure. Check that the sending platform actually signs with your domain selector, that the DNS DKIM record exists and matches, and that forwarding or modification has not broken the signature.
- Gmail 5.7.25 error: how to fix PTR / reverse-DNS failures on the sending IPGmail 5.7.25 is about the sending IP's reverse DNS. Identify the actual SMTP sending IP from the bounce or header, then check that the PTR record exists and the PTR hostname resolves back to the same IP.
- Gmail 5.7.29 error: message was not sent over TLSGmail 5.7.29 means Gmail blocked the message because it was not sent over a TLS connection. Check the actual outbound SMTP path, TLS support, certificates, relays, and logs before resending.
Email authentication
- Email authentication explained: SPF, DKIM, DMARC, and PTREmail authentication is built on four DNS-based signals — SPF authorizes who can send, DKIM cryptographically signs messages, DMARC enforces alignment with the visible From, and PTR proves the sending IP identity.
- SPF too many DNS lookups: fix the PermError before it silently breaks deliveryExceeding the 10-lookup SPF limit returns PermError, which prevents SPF from passing and can silently break DMARC alignment on every affected message.
- Multiple SPF records on one domain: why it causes permerror and how to fix itTwo or more v=spf1 records at the same domain name force a permerror result, preventing SPF from passing for any message from that domain.
- DKIM record not found: why the public key is missing and how to fix itA missing DKIM public-key record at the selector DNS name prevents the verifier from confirming the signature, leaving DKIM with no pass result.
- No DMARC record: what it means and how to fix itA missing DMARC record leaves your domain without alignment enforcement and can trigger bulk-sender rejections at Gmail, Yahoo, and Microsoft.
- Moving DMARC from p=none to p=reject without breaking your own mailMoving DMARC from p=none to p=reject safely requires reading reports, fixing every unaligned sender, and advancing through p=quarantine before enforcing.
- MTA-STS explained: enforce TLS for inbound email (testing to enforce)MTA-STS lets a domain require authenticated TLS for inbound SMTP via a DNS record and an HTTPS policy file. Three modes (testing, enforce, none) and a safe rollout.
- TLS-RPT explained: how to read SMTP TLS reportsTLS-RPT publishes a DNS record asking senders for aggregate reports on TLS, MTA-STS, and DANE success and failure. It is the observability layer for MTA-STS.
- BIMI explained: brand logos in the inbox (DMARC, SVG, and VMC requirements)BIMI displays your brand logo on authenticated mail. It requires DMARC at enforcement, an SVG Tiny PS logo, and usually a VMC. An emerging standard, not yet an RFC.
- DMARC aggregate (RUA) reports: what they are and how to read themA DMARC aggregate (RUA) report is the daily XML feedback receivers send showing, per sending source, how SPF, DKIM, and DMARC alignment evaluated. Read it to find every legitimate sender that is not yet aligned before you tighten policy.
- DKIM body hash did not verify: what causes it and how to fix itA DKIM body hash (bh=) mismatch means the message body changed after signing — usually a forwarder or list footer, content rewriting, or an encoding change — or a signing misconfiguration. It is not a missing-key or DNS problem.
- SPF PermError after adding a new sender: cause & fixA new sending platform added a second v=spf1 record or pushed your SPF past the 10-lookup limit, returning permerror so SPF no longer passes. Here is how to find which change broke it and merge safely.
- DKIM record published but messages arrive unsignedThe DKIM public key is published in DNS but messages still arrive with dkim=none because the sending platform was never switched on to sign. Here is how to tell the two apart and fix it.
- DKIM passes but DMARC fails: the alignment gapDKIM passes but DMARC still fails because the signing d= domain is not aligned with the visible From domain. Here is how relaxed vs strict alignment works and how to fix the gap.
- DMARC fails on SPF: return-path misalignment, fixedSPF passes yet DMARC fails because the return-path (envelope-from / MAIL FROM) domain is not aligned with the visible From. Here is what return-path alignment is and how to fix it.
- DMARC too strict for a third-party sender: the fixA DMARC p=reject or p=quarantine policy is bouncing a legitimate CRM or ESP. The fix is to authenticate and align the sender, not to weaken the policy. Here is how.
- Reverse DNS does not match HELO: causes and the fixA sending IP whose PTR (reverse DNS) does not match the HELO/EHLO greeting gets distrusted regardless of SPF/DKIM/DMARC. Here is why rDNS/HELO match matters and how to fix it.
Outlook & Microsoft 365
- Why Outlook blocks emails from your domainOutlook blocks emails when authentication, policy, reputation, content, or transport signals look unsafe. Check MX, SPF, DKIM, DMARC, blacklist, and TLS posture before blaming reputation alone.
- Outlook 5.7.23 SPF Failure: Fix the BounceAn Outlook 5.7.23 NDR means a Sender Policy Framework violation — the connecting IP is not authorized by your envelope sender domain SPF record. Here is why and how to fix it.
- Outlook 5.7.509 Fix: Domain Fails DMARC (policy reject)Outlook 5.7.509 means your sending domain does not pass DMARC and publishes a policy of reject. Align an SPF or DKIM result with your visible From domain. Here is how to fix it.
- Outlook 5.7.501 Fix: Access Denied, Spam Abuse DetectedOutlook 5.7.501 means the sending account was banned for detected spam activity. Reset credentials, fix the root cause, and use the Microsoft delisting path. Here is how.
- Outlook high SCL: why your mail is scored as spamA high Spam Confidence Level routes Outlook mail to Junk — there is no public 5.7.500 NDR code. It is reputation-driven, not an authentication bug. Here is what you can and cannot fix.
- Outlook 5.7.1 Fix: Delivery Not AuthorizedOutlook 5.7.1 means delivery was not authorized and the message was refused, usually by recipient policy or DMARC. Here is how to diagnose it.
- Outlook 5.7.511 Fix: Access Denied, Banned Sender (sending IP blocked)Outlook 5.7.511 means your sending IP was banned by Microsoft — a reputation block, not an authentication failure. Diagnose the IP, fix the cause, and request delisting.
- Outlook 5.7.800 Fix: Access Denied, Banned Sender (sending domain banned)Outlook 5.7.800 means your sending domain was banned by Microsoft for detected spam activity — a reputation block restored through Microsoft Support, not a self-service delist.
- Outlook 5.7.12 Fix: Sender Was Not Authenticated by OrganizationOutlook 5.7.12 means the recipient organization is set up to reject senders from outside it. Only the recipient admin can change it; confirm your auth and ask them to allow you.
- Outlook 5.7.25 Fix: Sending IPv6 Address Must Have a Reverse DNS RecordOutlook 5.7.25 means your sending IPv6 address has no reverse DNS (PTR) record. Microsoft requires a PTR plus SPF or DKIM over IPv6. Add the PTR or fall back to IPv4.
- Outlook 5.7.512 Fix: Message Must Be RFC 5322 Compliant (no valid From address)Outlook 5.7.512 means your message was sent without a valid RFC 5322 From header. It is a message-format problem, not authentication. Fix the sending app, script, or device.
- Outlook 5.7.510 Fix: Recipient Does Not Accept Email Over IPv6Outlook 5.7.510 means the recipient does not accept email over IPv6. Send over IPv4 instead. It is the mirror of 5.7.25 (your sending IPv6 missing a PTR).
- Outlook 5.7.134 Fix: Sender Was Not Authenticated for MailboxOutlook 5.7.134 means the recipient mailbox is set to reject senders from outside its organization. Only the recipient admin can change it; confirm your auth and ask them to allow you.
Sender requirements
- Gmail and Yahoo bulk sender requirements (2024)The February 2024 Gmail and Yahoo bulk-sender rules in one place — authentication and From-alignment, one-click unsubscribe, and a spam complaint rate under 0.3%.
- One-Click Unsubscribe (RFC 8058): the List-Unsubscribe Headers Gmail and Yahoo RequireBulk senders must support one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) — DKIM-signed, and honored within two days.
- Keep Your Spam Complaint Rate Below 0.3% (Gmail and Yahoo)Gmail and Yahoo require senders to keep the user-reported spam rate below 0.3% — keep it under 0.1%. How the rate is measured and how to lower it.
Deliverability
- Why are my emails going to spam? Causes, checks, and fixesThe reasons mail lands in spam instead of the inbox — authentication and alignment, sender reputation and engagement, list hygiene and complaints, and content — with the check and fix for each.
- How to test email deliverability before you hit sendRead the Authentication-Results header, watch Postmaster Tools and SNDS, run a seed-inbox placement test, and confirm SPF, DKIM, and DMARC pass — before a campaign goes out, not after.
- Email deliverability tools: what to test and how to read the resultsThe categories of deliverability tool — authentication, blacklist, content, seed-inbox placement, and reputation — what each one checks, and how to turn its output into a fix.
DNS records
- DNS record types: what each record does and how to read itThe DNS record types that run email and the web — SOA, A, AAAA, NS, PTR, CNAME, TXT, and CAA — what each one holds, how to read it, and how they fit together.
- What is an SOA record? DNS Start of Authority, explainedEvery DNS zone has exactly one SOA record — the Start of Authority. What its serial, refresh, retry, expire, and minimum (negative-cache) fields mean, and how to read them.
- What is an A record? DNS address records (and A vs CNAME)An A record maps a hostname to an IPv4 address. How it works, how to read one, why the apex needs an A record and not a CNAME, and how A differs from CNAME.
- What is an AAAA record? IPv6 DNS address recordsAn AAAA record maps a hostname to an IPv6 address — the 128-bit counterpart of the A record. How dual-stack works and why IPv6 senders need matching reverse DNS.
- What is a PTR record? Reverse DNS, explainedA PTR record maps an IP address back to a hostname — reverse DNS. How in-addr.arpa and ip6.arpa work, who sets a PTR, and why sending mail without one lands in spam.
- What is an NS record? DNS nameserver recordsNS records delegate a zone to its authoritative nameservers. How delegation, glue records, and the parent/child split work, and why you publish at least two.
- What is a CNAME record? DNS aliases (and CNAME vs A)A CNAME record points one name at another canonical name. How aliasing works, why no other record can sit beside a CNAME, why the apex cannot be a CNAME, and CNAME vs A.
- What is a TXT record? SPF, DKIM, DMARC, and verificationA TXT record holds free-form text at a DNS name. How it carries SPF, DKIM, and DMARC policy plus domain-verification strings, the 255-character rule, and why only one SPF record is allowed.
- What is a CAA record? Certificate Authority AuthorizationA CAA record tells certificate authorities which of them may issue certificates for your domain. How the issue, issuewild, and iodef tags work and when a CA checks them.
Provider setup guides
- How to set up SPF, DKIM, and DMARC (by email provider)Set up SPF, DKIM, DMARC, and MX for your domain — the exact DNS records and steps for Google Workspace, Microsoft 365, Gmail, Namecheap, and GoDaddy.
- How to set up SPF, DKIM, and DMARC for Google WorkspaceThe exact SPF, DKIM, DMARC, and MX records for a domain on Google Workspace — including generating the DKIM key in the Admin console.
- How to set up SPF, DKIM, and DMARC for Microsoft 365The SPF, DKIM, and DMARC records for Microsoft 365 (Office 365) — including the two selector CNAMEs and enabling DKIM in the Defender portal.
- Email authentication for Gmail: what you can set upYou cannot set SPF, DKIM, or DMARC for @gmail.com — Google owns it. What actually applies for a custom domain on Google and for Gmail "Send mail as".
- How to add SPF, DKIM, DMARC, and MX records in NamecheapWhere to add the SPF, DKIM, DMARC, and MX records your mailbox provider gave you in the Namecheap Advanced DNS panel — TXT, CNAME, and MX host formats.
- How to add SPF, DKIM, DMARC, and MX records in GoDaddyWhere to add the SPF, DKIM, DMARC, and MX records your mailbox provider gave you in the GoDaddy DNS panel — TXT, CNAME, and MX host formats.
SPF, DKIM & DMARC reference
- SPF record syntax: every mechanism, qualifier, and the 10-lookup limitThe full SPF record reference — every mechanism (all, include, a, mx, ip4, ip6), the four qualifiers, the redirect and exp modifiers, evaluation order, macros, and the 10 DNS-lookup limit.
- SPF ~all vs -all: what each qualifier tells receivers to doWhat ~all, -all, ?all, and +all instruct a receiver to do with unmatched mail — softfail vs hardfail vs neutral vs pass — and the honest read on why -all is not the riskier choice.
- DMARC policy modes: p=none, p=quarantine, and p=reject explainedWhat p=none, p=quarantine, and p=reject each ask a receiver to do, how sp= sets a separate subdomain policy, what pct= samples, and why a DMARC policy is a request, not a guarantee.
- DMARC alignment: relaxed vs strict, adkim and aspfHow DMARC alignment works — relaxed vs strict, the adkim and aspf modes, which identity aligns on the SPF and DKIM paths, and how the organizational domain is determined.
- DKIM selectors and keys: what they are and how to find yoursWhat a DKIM selector is and why it is arbitrary, the per-provider conventions, running several selectors and keys on one domain, the three ways to find yours, and the key record tags.
Phishing & link safety
- What is a phishing link? How to spot one and what to doA phishing link is a web address that impersonates a trusted site to steal your password or money. How to recognise one, what happens if you click, and what to do next.
- I clicked a phishing link: what to do nowClicked a phishing link? Do not panic. The steps to take right now: change passwords, turn on two-factor authentication, scan for malware, and watch for account activity.
- What happens if you click a phishing link?Clicking a phishing link can load a fake login page, start a download, or exploit an unpatched browser. What each outcome means and how much a single click really risks.
- Clicked a phishing link on your phone? iPhone and Android stepsWhat to do after tapping a phishing link on a phone. The specific steps for iPhone and Android, whether just visiting a page can infect a phone, and how to check for damage.
- How to tell if a link is safe before you clickA practical checklist for judging a link before you click: read the real domain, watch for look-alikes and shorteners, and know when a checker helps and when it cannot.