Email Delivery Troubleshooting Guide

When emails aren't reaching the inbox, authentication and deliverability issues are often the cause. This guide helps you diagnose and fix common email delivery problems.

Quick Diagnostic Checklist

Before diving deep, check these basics:

SPF record exists and is valid
DKIM is enabled and signing correctly
DMARC record is published
DMARC is passing (not failing)
Reverse DNS (PTR) records configured
Spam complaint rate below 0.3%
No blacklist entries
TLS encryption enabled

Common Delivery Issues

Issue 1: Emails Going to Spam Folder

Symptoms:

Emails consistently land in spam
Some recipients receive, others don't
Delivery is inconsistent

Diagnosis Steps:

Check Authentication:

# Check SPF
dig TXT yourdomain.com | grep "v=spf1"
 
# Check DKIM
dig TXT default._domainkey.yourdomain.com
 
# Check DMARC
dig TXT _dmarc.yourdomain.com

Send Test Email and Check Headers:
- Look for Authentication-Results header
- Verify SPF: pass
- Verify DKIM: pass
- Verify DMARC: pass
Check Spam Score:
- Use Mail-Tester.com
- Send test email
- Review spam score and issues

Common Causes:

❌ Missing or invalid SPF record
❌ DKIM not signing
❌ DMARC failing
❌ High spam complaint rate
❌ Poor sender reputation
❌ Blacklisted IPs

Solutions:

Fix Authentication:
Improve Reputation:
- Only send to opted-in subscribers
- Improve email content
- Increase engagement rates
- Remove inactive subscribers
Check Blacklists:
- Use MXToolbox blacklist checker
- Request removal if listed
- Investigate why listed

Issue 2: Authentication Failures

Symptoms:

SPF failures in DMARC reports
DKIM failures in headers
DMARC not passing

SPF Failures:

Diagnosis:

# Check SPF record
dig TXT yourdomain.com
 
# Test SPF from specific IP
spfquery -ip=203.0.113.100 yourdomain.com

Common Causes:

Sending IP not in SPF record
Missing service in SPF includes
SPF record syntax errors
Too many DNS lookups (>10)

Solutions:

Identify failing source from DMARC reports

Add missing service to SPF:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Add IP address if needed:

v=spf1 include:_spf.google.com ip4:203.0.113.100 -all

Fix syntax errors
Reduce DNS lookups if over limit

DKIM Failures:

Diagnosis:

# Check DKIM record
dig TXT default._domainkey.yourdomain.com
 
# Send test email and check headers
# Look for: dkim=fail (reason=...)

Common Causes:

DKIM not enabled on mail server
Public key not published in DNS
Selector mismatch
Key expired or rotated
Signature tampering

Solutions:

Enable DKIM on mail server
Publish public key in DNS
Verify selector matches DNS record name
Check key hasn't expired
Regenerate keys if needed

DMARC Failures:

Diagnosis:

Check DMARC reports in MailSentinel
Review failure reasons
Check alignment issues

Common Causes:

SPF alignment failure
DKIM alignment failure
Both SPF and DKIM failing
From: domain mismatch

Solutions:

Fix SPF Alignment:
- Ensure envelope sender matches From: domain
- Use same domain or subdomain
Fix DKIM Alignment:
- Ensure DKIM signing domain matches From: domain
- Configure DKIM to sign with correct domain
Fix Both Failures:
- Ensure at least one (SPF or DKIM) passes and aligns
- Fix underlying SPF/DKIM issues first

Issue 3: Emails Bouncing

Symptoms:

Bounce messages received
Emails rejected by receiving server
5xx error codes

Common Bounce Reasons:

550 5.7.1 - SPF Failure:

550 5.7.1 Message rejected due to SPF failure

Solution:

Fix SPF record
Add missing sending IPs
Verify SPF record syntax

550 5.7.1 - DMARC Failure:

550 5.7.1 Message rejected due to DMARC policy

Solution:

Fix SPF/DKIM alignment
Ensure DMARC passes
Check DMARC policy (may be too strict)

550 5.7.26 - Authentication Required:

550 5.7.26 This message does not pass authentication checks

Solution:

Set up SPF and DKIM
Configure DMARC
Ensure authentication passes

554 5.7.1 - Blacklisted:

554 5.7.1 Sender IP is blacklisted

Solution:

Check blacklist status
Request removal
Investigate why listed

Issue 4: Inconsistent Delivery

Symptoms:

Some emails delivered, others not
Delivery varies by recipient
Some providers accept, others reject

Diagnosis:

Check Provider-Specific Issues:
- Gmail: Check Postmaster Tools
- Outlook: Check SNDS
- Yahoo: Check Sender Hub
Review DMARC Reports:
- Check which providers are failing
- Identify patterns
- Review failure reasons
Test Across Providers:
- Send to Gmail, Outlook, Yahoo
- Check delivery to each
- Compare results

Common Causes:

Provider-specific reputation issues
Different authentication requirements
Provider-specific filtering
Volume-based throttling

Solutions:

Fix authentication for all providers
Monitor provider-specific tools
Improve sender reputation
Reduce sending volume if throttled

Issue 5: High Spam Complaint Rate

Symptoms:

Spam rate above 0.3%
Emails going to spam
Reputation declining

Diagnosis:

Check Spam Rates:
- Google Postmaster Tools
- Microsoft SNDS
- Yahoo Sender Hub
Review Email Practices:
- Opt-in process
- Email content
- Unsubscribe process
- List hygiene

Common Causes:

Sending to non-opted-in subscribers
Poor email content
Hidden unsubscribe links
Purchased email lists
Low engagement rates

Solutions:

Improve List Quality:
- Use double opt-in
- Remove inactive subscribers
- Don't purchase lists
- Clean lists regularly
Improve Email Content:
- Relevant, valuable content
- Clear sender identification
- Professional design
- Avoid spam trigger words
Make Unsubscribe Easy:
- Prominent unsubscribe link
- One-click unsubscribe headers
- Process requests immediately
- Honor preferences
Increase Engagement:
- Segment lists
- Send relevant content
- Personalize emails
- Test send times