Email delivery issues can range from simple configuration problems to complex reputation issues. This guide provides systematic troubleshooting workflows to diagnose and fix the most common email delivery problems.
┌─────────────────────────────────────────────────────────────────────────────┐
│ EMAIL DELIVERY TROUBLESHOOTING FLOWCHART │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────┐ │
│ │ Email not delivered │ │
│ │ or in spam? │ │
│ └──────────┬──────────┘ │
│ │ │
│ ┌───────────────┴───────────────┐ │
│ ▼ ▼ │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ Did sender receive │ YES │ Email delivered │ │
│ │ bounce/NDR? │────────▶│ but in spam folder │ │
│ └──────────┬──────────┘ └──────────┬──────────┘ │
│ │ NO │ │
│ ▼ ▼ │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ Check: │ │ Check: │ │
│ │ • Server logs │ │ • Authentication │ │
│ │ • Outbound queue │ │ • Sender reputation │ │
│ │ • Network/firewall │ │ • Content triggers │ │
│ │ • DNS issues │ │ • Blacklists │ │
│ └─────────────────────┘ └─────────────────────┘ │
│ │
│ ───────────────────────────────────────────────────────────────────────── │
│ │
│ BOUNCE MESSAGE ANALYSIS: │
│ │
│ 5xx (Permanent) 4xx (Temporary) │
│ ┌──────────────────────┐ ┌──────────────────────┐ │
│ │ 550 - User unknown │───▶ │ 421 - Server busy │───▶ Auto-retry │
│ │ 551 - User moved │ │ 450 - Mailbox unavail│ │
│ │ 552 - Over quota │ │ 451 - Local error │ │
│ │ 553 - Invalid address│ │ 452 - Insufficient │ │
│ │ 554 - Rejected │ │ storage │ │
│ └──────────┬───────────┘ └──────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ 5.1.x - Address status │ 5.5.x - Mail system status │ │
│ │ 5.2.x - Mailbox status │ 5.6.x - Media status │ │
│ │ 5.3.x - Mail system status │ 5.7.x - Security/policy │◀── Most │
│ │ 5.4.x - Network status │ │ common │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
| Code | Description | Common Cause | Solution |
|---|
| 550 5.7.1 | Message rejected | SPF/DMARC failure, blacklisted | Check authentication, blacklists |
| 550 5.7.23 | SPF validation failed | Sending IP not in SPF | Add IP to SPF record |
| 550 5.7.26 | DMARC failure | Auth failed or not aligned | Fix SPF/DKIM alignment |
| 553 5.7.1 | Sender address rejected | Invalid From address | Use valid sender domain |
| 554 5.7.1 | Relay access denied | Not authorized to send | Configure proper relay auth |
| Code | Description | Common Cause | Solution |
|---|
| 550 5.1.1 | User unknown | Email address doesn't exist | Verify recipient address |
| 550 5.1.2 | Domain not found | Invalid domain | Check domain spelling |
| 550 5.1.8 | Sender address rejected | Invalid sender | Fix From address |
| Code | Description | Common Cause | Solution |
|---|
| 550 5.2.1 | Mailbox disabled | Account suspended | Contact recipient |
| 552 5.2.2 | Mailbox full | Over quota | Recipient must clear space |
| 552 5.2.3 | Message too large | Exceeds size limit | Reduce attachment size |
| Code | Description | Common Cause | Solution |
|---|
| 421 | Service unavailable | Server busy | Wait for auto-retry |
| 450 | Mailbox unavailable | Temporary issue | Wait for auto-retry |
| 451 | Local error | Processing issue | Check later |
| 452 | Insufficient storage | Disk space | Wait for cleanup |
┌─────────────────────────────────────────────────────────────────────────────┐
│ SPF TROUBLESHOOTING WORKFLOW │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ STEP 1: Check Current SPF Record │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ $ dig +short TXT example.com | grep spf │ │
│ │ "v=spf1 include:_spf.google.com ~all" │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 2: Identify Sending IP │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Check email headers for "Received: from" - look for your server IP │ │
│ │ Or check Authentication-Results for smtp.mailfrom IP │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 3: Verify IP is Authorized │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Use SPF checker: mxtoolbox.com/spf.aspx │ │
│ │ Enter: example.com and sending IP │ │
│ │ │ │
│ │ Expected: PASS │ │
│ │ If FAIL: IP not authorized → Add to SPF record │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ COMMON SPF FIXES: │
│ │
│ Problem: IP not in SPF │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Before: v=spf1 include:_spf.google.com ~all │ │
│ │ After: v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ Problem: Missing include for email service │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Before: v=spf1 include:_spf.google.com ~all │ │
│ │ After: v=spf1 include:_spf.google.com include:sendgrid.net ~all │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ Problem: Too many DNS lookups (>10) │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Solutions: │ │
│ │ • Flatten SPF record (replace includes with IPs) │ │
│ │ • Use SPF macro syntax │ │
│ │ • Split across subdomains │ │
│ │ See: /blog/spf-10-dns-lookup-limit │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
dig +short TXT selector._domainkey.example.com
┌─────────────────────────────────────────────────────────────────────────────┐
│ DMARC TROUBLESHOOTING │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ DMARC requires: (SPF Pass + SPF Aligned) OR (DKIM Pass + DKIM Aligned) │
│ │
│ ALIGNMENT CHECK: │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ │ │
│ │ From: user@example.com ← RFC5322.From (visible to user) │ │
│ │ │ │
│ │ SPF Alignment (aspf): │ │
│ │ Return-Path: bounce@example.com ← Must match From domain │ │
│ │ bounce@mail.example.com ← Works with aspf=r (relaxed) │ │
│ │ bounce@different.com ← FAILS alignment │ │
│ │ │ │
│ │ DKIM Alignment (adkim): │ │
│ │ DKIM d=example.com ← Must match From domain │ │
│ │ d=mail.example.com ← Works with adkim=r (relaxed) │ │
│ │ d=different.com ← FAILS alignment │ │
│ │ │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ COMMON DMARC FIXES: │
│ │
│ Problem: Third-party sender not aligned │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ SendGrid sends with: │ │
│ │ Return-Path: bounce@sendgrid.net (SPF passes for sendgrid.net) │ │
│ │ DKIM d=sendgrid.net │ │
│ │ From: user@example.com │ │
│ │ │ │
│ │ DMARC fails because neither aligns with example.com! │ │
│ │ │ │
│ │ Fix: Configure custom domain for DKIM signing │ │
│ │ - In SendGrid, set up domain authentication for example.com │ │
│ │ - SendGrid will then sign with d=example.com → DKIM aligns │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ Problem: Forwarded email fails DMARC │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ When email is forwarded: │ │
│ │ - SPF fails (forwarding server IP not in sender's SPF) │ │
│ │ - DKIM may survive if message unchanged │ │
│ │ │ │
│ │ Solutions: │ │
│ │ - Rely on DKIM for alignment (ensure DKIM survives forwarding) │ │
│ │ - Use ARC (Authenticated Received Chain) if supported │ │
│ │ - Consider relaxed DMARC policy for mailing lists │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
IP="203.0.113.10"
REVERSED=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
for BL in zen.spamhaus.org bl.spamcop.net b.barracudacentral.org; do
dig +short $REVERSED.$BL
done
| Blacklist | Check URL | Delisting Process |
|---|
| Spamhaus | spamhaus.org/lookup | Submit removal request, fix issue |
| Barracuda | barracudacentral.org/lookups | Register, request removal |
| SpamCop | spamcop.net/bl.shtml | Usually auto-expires in 24h |
| SORBS | sorbs.net | Request delisting via web form |
| Proofpoint | ipcheck.proofpoint.com | Contact Proofpoint support |
| Microsoft | sender.office.com | Submit through portal |
┌─────────────────────────────────────────────────────────────────────────────┐
│ BLACKLIST REMOVAL PROCESS │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ STEP 1: Identify the Cause │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Common reasons for blacklisting: │ │
│ │ • Compromised server sending spam │ │
│ │ • Compromised user account │ │
│ │ • Open relay configuration │ │
│ │ • Sending to spam traps (old/invalid addresses) │ │
│ │ • High complaint rate from recipients │ │
│ │ • Malware on the network │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 2: Fix the Underlying Issue │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ • Scan servers for malware/compromise │ │
│ │ • Reset compromised passwords │ │
│ │ • Close open relays │ │
│ │ • Clean email lists (remove invalids, unsubscribes) │ │
│ │ • Implement rate limiting │ │
│ │ • Add SPF, DKIM, DMARC if missing │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 3: Document the Fix │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Prepare for delisting request: │ │
│ │ • What was the issue │ │
│ │ • When it was discovered │ │
│ │ • What was done to fix it │ │
│ │ • What measures prevent recurrence │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 4: Request Delisting │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ • Visit blacklist's removal page │ │
│ │ • Submit IP address and explanation │ │
│ │ • Provide contact information │ │
│ │ • Wait for processing (hours to days) │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ STEP 5: Monitor for Re-listing │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ • Set up automated blacklist monitoring │ │
│ │ • Continue monitoring mail logs │ │
│ │ • Watch for spam complaints │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────────────┐
│ SPAM FOLDER CAUSES & FIXES │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ AUTHENTICATION ISSUES (Most Common) │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Problem │ Check │ Fix │ │
│ ├────────────────────────┼────────────────────────┼──────────────────────┤ │
│ │ SPF not passing │ Auth headers show fail │ Update SPF record │ │
│ │ DKIM not signing │ No DKIM-Signature │ Configure DKIM │ │
│ │ DMARC not passing │ dmarc=fail in headers │ Fix alignment │ │
│ │ No reverse DNS (PTR) │ dig -x <IP> │ Configure PTR record │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ REPUTATION ISSUES │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Problem │ Check │ Fix │ │
│ ├────────────────────────┼────────────────────────┼──────────────────────┤ │
│ │ IP blacklisted │ Blacklist checkers │ Delist + fix cause │ │
│ │ Poor sender score │ SenderScore.org │ Improve practices │ │
│ │ Domain reputation │ Google Postmaster │ Reduce complaints │ │
│ │ Shared IP issues │ Check IP neighbors │ Get dedicated IP │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ CONTENT ISSUES │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Spam Triggers: │ │
│ │ • ALL CAPS SUBJECT LINES │ │
│ │ • Excessive exclamation marks!!! │ │
│ │ • Spam phrases: "Act now!", "Free!", "Click here" │ │
│ │ • Image-only emails (no text) │ │
│ │ • Poor HTML formatting │ │
│ │ • Unsubscribe link missing │ │
│ │ • URL shorteners (bit.ly, etc.) │ │
│ │ • Suspicious attachments │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
│ ENGAGEMENT ISSUES │
│ ┌───────────────────────────────────────────────────────────────────────┐ │
│ │ Problem │ Impact │ Fix │ │
│ ├────────────────────────┼────────────────────────┼──────────────────────┤ │
│ │ Low open rates │ Signals unwanted mail │ Better subject lines │ │
│ │ High bounce rates │ Poor list quality │ Clean list regularly │ │
│ │ Many spam reports │ Direct negative signal │ Make unsub easy │ │
│ │ Low interaction │ Low priority for inbox │ Engage users more │ │
│ └───────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
# Check reputation at:
# https://sender.office.com/
# Microsoft SNDS (Smart Network Data Services)
# https://sendersupport.olc.protection.outlook.com/snds/
# Key requirements:
# - Valid SPF, DKIM, DMARC
# - Proper reverse DNS
# - Not on Microsoft's block list
# - Compliance with email sending best practices
dig +short MX example.com
dig +short TXT example.com | grep spf
dig +short TXT selector._domainkey.example.com
dig +short TXT _dmarc.example.com
dig +short -x 203.0.113.10
nc -v mail.example.com 25
openssl s_client -connect mail.example.com:25 -starttls smtp
telnet mail.example.com 25
HELO test.example.com
MAIL FROM: <test@example.com>
RCPT TO: <recipient@example.com>
DATA
Subject: Test email
This is a test.
.
QUIT
┌─────────────────────────────────────────────────────────────────────────────┐
│ EMAIL DELIVERABILITY CHECKLIST │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ AUTHENTICATION (Essential) │
│ [ ] SPF record configured and includes all sending IPs/services │
│ [ ] DKIM signing enabled for all outbound email │
│ [ ] DMARC policy set (start with p=none, monitor, then enforce) │
│ [ ] PTR (reverse DNS) configured for sending IPs │
│ [ ] All authentication passing in test emails │
│ │
│ INFRASTRUCTURE │
│ [ ] Dedicated IP for high-volume sending (>50k/month) │
│ [ ] Proper HELO/EHLO hostname matching PTR │
│ [ ] TLS enabled for sending and receiving │
│ [ ] Rate limiting configured to prevent abuse │
│ [ ] Logs retained for troubleshooting (30+ days) │
│ │
│ LIST MANAGEMENT │
│ [ ] Double opt-in for marketing lists │
│ [ ] Bounce handling (remove hard bounces immediately) │
│ [ ] Unsubscribe handling (honor within 10 days per CAN-SPAM) │
│ [ ] Regular list cleaning (remove inactive 6+ months) │
│ [ ] Never purchase email lists │
│ │
│ MONITORING │
│ [ ] Blacklist monitoring automated │
│ [ ] DMARC reports analyzed regularly │
│ [ ] Google Postmaster Tools configured │
│ [ ] Microsoft SNDS enrolled │
│ [ ] Bounce rates tracked (<2% target) │
│ [ ] Spam complaint rates tracked (<0.1% target) │
│ │
│ CONTENT │
│ [ ] Text and HTML versions of marketing emails │
│ [ ] Proper unsubscribe link in all marketing emails │
│ [ ] Physical address included (CAN-SPAM requirement) │
│ [ ] Avoid spam trigger words and formatting │
│ [ ] Test emails before sending campaigns │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
IP="203.0.113.10"
REVERSED=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
EMAIL="admin@example.com"
BLACKLISTS=(
"zen.spamhaus.org"
"bl.spamcop.net"
"b.barracudacentral.org"
"dnsbl.sorbs.net"
"bl.spameatingmonkey.net"
)
for BL in "${BLACKLISTS[@]}"; do
RESULT=$(dig +short $REVERSED.$BL)
if [ -n "$RESULT" ]; then
echo "ALERT: $IP listed on $BL" | mail -s "Blacklist Alert" $EMAIL
fi
done