Guides
Every guide, in one place
Each one starts from a problem you might be having and ends with a record you can publish. No prior knowledge of email authentication assumed.
New here? Start with Someone is sending email as my domain — it tells you which problem you actually have before you change any DNS.
-
Getting started
How to check if your domain can be spoofed
Find out whether anyone can send email as your domain — in about two minutes, without sending a message. How to run the check and read all three results.
-
SPF
SPF: too many DNS lookups
SPF allows ten DNS lookups. Go over and receivers ignore your record entirely. How to count them, and the three ways to get back under.
-
Bulk senders
Google and Yahoo sender requirements: a pass/fail checklist
The twelve Gmail and Yahoo sender requirements, each with what counts as passing — and which ones no DNS lookup can settle.
-
SPF
SPF: should it end in ~all or -all?
The difference matters far less than the arguments about it suggest, and the settings people choose instead of either are the ones that actually break things.
-
Error messages
554 5.7.5 permanent error evaluating DMARC policy
Gmail rejected your mail because it could not reach a usable DMARC result. Almost always your DNS, not the message. How to tell which of three causes it is.
-
DMARC
What DMARC p=none actually does
p=none collects reports and blocks nothing. It is the right place to start and the wrong place to stop. How to get to enforcement without losing mail.
-
Providers
Setting up DMARC on Google Workspace
The steps, plus the three places Google's own instructions cost you: a deprecated tag they still recommend, a report tag Gmail ignores, and the 48-hour wait.
-
Providers
Setting up DMARC on Microsoft 365
M365 signs your mail with onmicrosoft.com by default, which does not align with your own domain. Why DMARC still fails with DKIM switched on, and the fix.
-
DMARC
Why DMARC fails when SPF and DKIM pass
Passing SPF is not enough — the domain that passed has to match the one your recipient sees. How to read alignment from your own message headers.
-
Providers
SPF, DKIM and DMARC on Cloudflare DNS
Cloudflare hosts your DNS, it does not send your mail. The orange cloud, the inbound-only Email Routing trap, and what DMARC Management changes in your record.
-
Providers
Email authentication for Shopify
Store mail showing as store+123@shopifyemail.com means Shopify rewrote it: your domain isn't authenticated. What to publish, and the DMARC tag that breaks it.
-
DMARC
Your DMARC reports may be going nowhere
A DMARC record can look flawless and still deliver you no reports at all. Two failure modes that leave you blind, and how to check for both.
-
DKIM
SPF passed but DKIM failed
SPF passing tells you nothing about DKIM — they check different things. The real causes of a DKIM failure, and how to read which one you have.
-
SPF
DKIM passed but SPF failed
SPF breaks on forwarded mail by design, and DMARC still passes on the DKIM signature. Which SPF failures need fixing and which you should ignore.
-
DKIM
Finding your DKIM selector
DKIM selectors cannot be listed from DNS. Why every checker is guessing, how to find yours anyway, and the trap that makes tools report keys that don't exist.
-
DKIM
DKIM selectors by provider
The DKIM selector each major provider uses — and which are unguessable by design.
Why a message bounced
Twenty-one more guides decode a specific SMTP rejection. These are the ones people arrive needing most:
-
Bounces
Microsoft 5.7.606 — your sending IP is blocked
-
Bounces
Mimecast rejected your message
-
Bounces
Outlook S3150 — blocked by reputation
-
Bounces
Microsoft 5.7.23 — SPF validation failed
-
Bounces
5.1.2 — the recipient domain does not resolve
-
Bounces
550 5.1.1 — no such user
- Bounce guides — Twenty-one guides, one per SMTP error worth its own page: what it means, whose problem it is, and the fix. Paste a bounce and it finds the right one.
- TLS-RPT result guides — Every failure type RFC 8460 defines, explained one page at a time — and whether it means inbound mail was refused or merely sent unencrypted.
- Deliverability tool guides — One-click unsubscribe, MTA-STS, TLS-RPT setup, Postmaster Tools and the Gmail and Yahoo requirements, each alongside the tool that checks it.