Fix it
One error per page: what the message actually means, why it happens, the fix, and how to confirm the fix worked.
Fix 421 service not available
A 421 is a temporary failure, usually a receiver rate-limiting your IP. Cut concurrent connections and retry with backoff. The address is not invalid.
Fix 550 5.1.1 user unknown
A 550 5.1.1 means the server found no mailbox for that address, the clearest hard bounce there is. Suppress it for good and trace where it came from.
Fix 550 5.7.1 blocked
A 550 5.7.1 is a policy rejection aimed at you, not the recipient, so the mailbox almost certainly exists. Read the text after the code and check blocklists.
Fix 552 mailbox full
A 552 5.2.2 means a full mailbox on a valid address, while 5.2.3 and 5.3.4 mean your message was too big. Retry first, then suppress repeat failures.
Fix 554 transaction failed
A 554 is a permanent rejection the server does not explain, so the diagnosis is in the text after the code. Group 554s by receiving domain first.
Fix Apple Mail Privacy Protection
Apple Mail Privacy Protection preloads images through a proxy, so an open is recorded whether or not anyone read the message. Base sunset rules on clicks.
Fix BIMI logo not displaying
A BIMI logo shows only when DMARC is at quarantine or reject, the SVG is Tiny Portable/Secure and, for Gmail, you hold a Verified Mark Certificate.
Fix DKIM body hash mismatch
A DKIM body hash mismatch means the key verified but the body changed after signing, usually a gateway footer or rewritten links. Do not rotate the key.
Fix DKIM record not found
DKIM record not found means DNS returned nothing at selector._domainkey on your domain. Read the selector from a real message and check for a doubled name.
Fix DKIM signature invalid
An invalid DKIM signature means the receiver recomputed the hash and got a different answer. Look for mail changed in transit or a one-sided key rotation.
Fix DMARC alignment failure
DMARC alignment fails when SPF or DKIM passes for a domain other than the one in your From header. Set a custom return path and sign with your own domain.
Fix DMARC fail
DMARC fails when neither SPF nor DKIM passes in alignment with your From domain. Read the aggregate reports, fix each real source, then tighten in stages.
Fix DMARC record not found
DMARC record not found means there is no TXT record at _dmarc on your domain. Publish a monitoring policy, read reports for two weeks, then tighten it.
Fix Domain on Barracuda
A Barracuda listing puts your sending IP on the BRBL, which corporate mail filters query. Consumer delivery can look fine while B2B mail is refused.
Fix Domain on Spamhaus
A Spamhaus listing turns into refused connections at the many servers that query it. Find which list you are on, fix the cause, then request removal once.
Fix Email going to spam
Mail in the spam folder was accepted and then judged unwanted, which is a reputation problem. Fix SPF, DKIM and DMARC first and keep complaints under 0.3%.
Fix Feedback loop setup
A feedback loop forwards you each message a user marked as spam. Enroll with every provider that runs one and suppress complainers immediately.
Fix Gmail bulk sender requirements
Gmail requires anyone sending more than 5,000 messages a day to pass SPF, DKIM and DMARC, support one-click unsubscribe, and keep complaints below 0.3%.
Fix Google Postmaster Tools setup
Google Postmaster Tools shows Gmail's own view of your spam rate, authentication and delivery errors. Add the domain that signs your DKIM or it stays empty.
Fix IP on SpamCop
A SpamCop listing comes from user reports and trap hits against your IP, and it expires about 24 hours after the reports stop. Stop the source and wait.
Fix List-Unsubscribe header missing
Google and Yahoo require a List-Unsubscribe header on bulk mail. One-click needs an HTTPS URL plus List-Unsubscribe-Post, and a mailto link alone fails.
Fix Microsoft SMTP throttling
Microsoft defers mail from senders it does not trust yet with temporary 4xx responses. Cut concurrent connections, because adding more makes it worse.
Fix Microsoft SNDS setup
Microsoft SNDS shows complaint rates and filter results for IPs you control. It moved to a new portal, and trap hit counts left the report on July 22, 2026.
Fix MTA-STS policy error
An MTA-STS policy error means your policy file no longer matches your MX hosts or certificates, often after a provider change. Drop to testing mode first.
Fix MX lookup failed
An MX lookup failure means the DNS query errored or timed out, which is not the same as a domain with no MX. Check delegation, DNSSEC and registration.
Fix MX record missing
A missing MX record leaves senders nothing to connect to except an A record fallback. Publish your provider's records, or a null MX for a no-mail domain.
Fix One-click unsubscribe not working
One-click unsubscribe fails when your endpoint rejects the provider's POST, asks for a login or shows a confirmation page. It must act on that request.
Fix Outlook junk filter
Outlook junk filtering mixes Microsoft reputation data with tenant and user rules, so one company can inbox and junk the same message. Check SNDS first.
Fix PTR record missing
A missing PTR record means a reverse lookup on your sending IP returns nothing, which many receivers read as an unmanaged sender. Ask the IP owner for one.
Fix Reverse DNS mismatch
A reverse DNS mismatch means the PTR hostname does not resolve back to your sending IP, so forward-confirmed reverse DNS fails. Fix whichever half is wrong.
Fix Soft bounce loop
A soft bounce loop is one address failing temporarily on every send while your platform keeps retrying. Group repeats by domain and set a suppression rule.
Fix SPF neutral
SPF neutral means the sending IP matched a ? mechanism, fell through to ?all, or hit a record with no all term. Add the missing sender, then move to ~all.
Fix SPF permerror
SPF permerror means receivers cannot evaluate your record, usually from two SPF records, over ten DNS lookups or a syntax error. DMARC counts it as a fail.
Fix SPF record not found
SPF record not found means no TXT record starting v=spf1 exists on your sending domain. List every sender, build one record, and publish it at the root.
Fix SPF too many DNS lookups
SPF allows ten DNS lookups, and nested includes count toward them. Go past ten and the check returns permerror, so remove unused senders or use a subdomain.
Fix TLS negotiation failed
A TLS negotiation failure means the handshake between two mail servers broke, most often on an expired certificate. Test with openssl and keep TLS on.
Fix VMC certificate problems
A Verified Mark Certificate needs a registered trademark, a logo that matches it exactly and a compliant SVG. It expires yearly, and the logo goes with it.
Fix Yahoo sender requirements
Yahoo requires bulk senders to pass SPF, DKIM and DMARC, support one-click unsubscribe, and stay under 0.3% complaints. The same rules cover AOL.
Run a sample through it
100 free checks a month, no card, and the unknowns come back labeled.