Home

Fix it

One error per page: what the message actually means, why it happens, the fix, and how to confirm the fix worked.

Fix 421 service not available

A 421 is a temporary failure, usually a receiver rate-limiting your IP. Cut concurrent connections and retry with backoff. The address is not invalid.

Fix 550 5.1.1 user unknown

A 550 5.1.1 means the server found no mailbox for that address, the clearest hard bounce there is. Suppress it for good and trace where it came from.

Fix 550 5.7.1 blocked

A 550 5.7.1 is a policy rejection aimed at you, so the mailbox almost certainly exists. Read the text after the code and check the blocklists.

Fix 552 mailbox full

A 552 5.2.2 means a full mailbox on a valid address, while 5.2.3 and 5.3.4 mean your message was too big. Retry first, then suppress repeat failures.

Fix 554 transaction failed

A 554 is a permanent rejection the server does not explain, so the diagnosis is in the text after the code. Group 554s by receiving domain first.

Fix Apple Mail Privacy Protection

Apple Mail Privacy Protection preloads images through a proxy, so an open is recorded whether or not anyone read the message. Base sunset rules on clicks.

Fix BIMI logo not displaying

A BIMI logo shows only when DMARC is at quarantine or reject, the SVG is Tiny Portable/Secure and, for Gmail, you hold a Verified Mark Certificate.

Fix DKIM body hash mismatch

A DKIM body hash mismatch means the key verified but the body changed after signing, usually a gateway footer or rewritten links. Do not rotate the key.

Fix DKIM record not found

DKIM record not found means DNS returned nothing at selector._domainkey on your domain. Read the selector from a real message and check for a doubled name.

Fix DKIM signature invalid

An invalid DKIM signature means the receiver recomputed the hash and got a different answer. Look for mail changed in transit or a one-sided key rotation.

Fix DMARC alignment failure

DMARC alignment fails when SPF or DKIM passes for a domain other than the one in your From header. Set a custom return path and sign with your own domain.

Fix DMARC fail

DMARC fails when neither SPF nor DKIM passes in alignment with your From domain. Read the aggregate reports, fix each real source, then tighten in stages.

Fix DMARC record not found

DMARC record not found means there is no TXT record at _dmarc on your domain. Publish a monitoring policy, read reports for two weeks, then tighten it.

Fix Domain on Barracuda

A Barracuda listing puts your sending IP on the BRBL, which corporate mail filters query. Consumer delivery can look fine while B2B mail is refused.

Fix Domain on Spamhaus

A Spamhaus listing turns into refused connections at the many servers that query it. Find which list you are on, fix the cause, then request removal once.

Fix Email going to spam

Mail in the spam folder was accepted and then judged unwanted, which is a reputation problem. Fix SPF, DKIM and DMARC first and keep complaints under 0.3%.

Fix Feedback loop setup

A feedback loop forwards you each message a user marked as spam. Enroll with every provider that runs one and suppress complainers immediately.

Fix Gmail bulk sender requirements

Gmail requires anyone sending more than 5,000 messages a day to pass SPF, DKIM and DMARC, support one-click unsubscribe, and keep complaints below 0.3%.

Fix Google Postmaster Tools setup

Set up Google Postmaster Tools to see Gmail's view of your spam rate against the 0.3% limit. Add the domain that signs your DKIM, or it stays empty.

Fix IP on SpamCop

A SpamCop listing comes from user reports and trap hits against your IP, and it expires about 24 hours after the reports stop. Stop the source and wait.

Fix List-Unsubscribe header missing

Google and Yahoo require a List-Unsubscribe header on bulk mail. One-click needs an HTTPS URL plus List-Unsubscribe-Post, and a mailto link alone fails.

Fix Microsoft SMTP throttling

Microsoft defers mail from senders it does not trust yet with temporary 4xx responses. Cut concurrent connections, because adding more makes it worse.

Fix Microsoft SNDS setup

Set up Microsoft SNDS to see complaint rates and filter results for your IPs. It moved portals, and trap hit counts left the report on July 22, 2026.

Fix MTA-STS policy error

An MTA-STS policy error means your policy file no longer matches your MX hosts or certificates, often after a provider change. Drop to testing mode first.

Fix MX lookup failed

An MX lookup failure means the DNS query errored or timed out, which is not the same as a domain with no MX. Check delegation, DNSSEC and registration.

Fix MX record missing

A missing MX record leaves senders nothing to connect to except an A record fallback. Publish your provider's records, or a null MX for a no-mail domain.

Fix One-click unsubscribe not working

One-click unsubscribe fails when your endpoint rejects the provider's POST, asks for a login or shows a confirmation page. It must act on that request.

Fix Outlook junk filter

Outlook junk filtering mixes Microsoft reputation data with tenant and user rules, so one company can inbox and junk the same message. Check SNDS first.

Fix PTR record missing

A missing PTR record means a reverse lookup on your sending IP returns nothing, which many receivers read as an unmanaged sender. Ask the IP owner for one.

Fix Reverse DNS mismatch

A reverse DNS mismatch means your PTR hostname doesn't resolve back to the sending IP. Check both lookups, then fix whichever of the 2 halves is wrong.

Fix Soft bounce loop

A soft bounce loop is one address failing temporarily on every send while your platform keeps retrying. Group repeats by domain and set a suppression rule.

Fix SPF neutral

SPF neutral means the sending IP matched a ? mechanism, fell through to ?all, or hit a record with no all term. Add the missing sender, then move to ~all.

Fix SPF permerror

SPF permerror means receivers cannot evaluate your record, usually from two SPF records, over ten DNS lookups or a syntax error. DMARC counts it as a fail.

Fix SPF record not found

SPF record not found means no TXT record starting v=spf1 exists on your sending domain. List every sender, build one record, and publish it at the root.

Fix SPF too many DNS lookups

SPF allows 10 DNS lookups, and nested includes count. Go past 10 and the check returns permerror. Cut unused senders or move some to a subdomain.

Fix TLS negotiation failed

A TLS negotiation failure means the handshake between two mail servers broke, most often on an expired certificate. Test with openssl and keep TLS on.

Fix VMC certificate problems

A Verified Mark Certificate needs a registered trademark, a logo that matches it exactly and a compliant SVG. It expires yearly, and the logo goes with it.

Fix Yahoo sender requirements

Yahoo requires bulk senders to pass SPF, DKIM and DMARC, support one-click unsubscribe, and stay under 0.3% complaints. The same rules cover AOL.

Run a sample through it

100 free checks a month, no card, and the unknowns come back labeled.

Get an API key How we report accuracy