Tagged “troubleshooting”

29 May 2026 · 13 min read

Why DMARC fails when SPF and DKIM pass

SPF passes, DKIM passes, yet DMARC still fails on legitimate mail. The cause is almost always alignment: both checks authenticated a domain other than the one in your From header. Here is how to find the misaligned identifier in a single message header and across all sources in your aggregate reports, then fix each cause.

28 May 2026 · 10 min read

DMARC says quarantine but mail still reaches the inbox

A quarantine policy does not always mean the spam folder. Here is why failing mail still lands in the inbox: pct sampling, alignment, receiver discretion, DNS caching, and exactly what to check.

26 May 2026 · 13 min read

DMARC reports show sources I do not recognise

Unknown sending IPs in your DMARC aggregate reports are normal, not an emergency. Here is a reliable four-question triage to tell shadow IT and forwarders from real spoofers, and exactly what to do with each.

20 April 2026 · 12 min read

Fix: BIMI logo not showing in Gmail

Gmail shows a grey initial instead of your BIMI logo and never says why. Here is every reason it fails, in the order Gmail checks them: DMARC not at enforcement, a missing VMC, an SVG that breaks the Tiny PS profile, a logo-to-certificate mismatch, and cached negative results, plus how to fix each.

19 April 2026 · 12 min read

Fix: DKIM fails after forwarding

Forwarders and mailing lists break DKIM by changing the message body and headers, not the connection. Here is exactly what fails, what survives, where ARC helps, how to spot forwarding failures in your DMARC reports, and how to reduce the impact without parking at p=none.

18 April 2026 · 13 min read

Fix: DKIM public key not found in DNS

The "DKIM public key not found in DNS" error is almost always a naming or publishing problem, not a broken key. Here is exactly which name receivers query, why it returns nothing, how CNAME and TXT publishing differ, and how to confirm the key resolves end to end.

17 April 2026 · 13 min read

Fix: DKIM signature did not verify

"DKIM signature did not verify" is at least six different problems wearing one error string: body hash mismatch, no key in DNS, malformed record, key mismatch after rotation, expired signature, or a key too short. Here is how to read the exact reason in the brackets and apply the one correct fix for each.

16 April 2026 · 13 min read

Fix: MTA-STS policy not found

"MTA-STS policy not found" is never one problem: it is a five-link chain (DNS TXT, HTTPS host, certificate, file path, file content) plus the MX-coverage trap, and it fails silently because senders fall back to opportunistic TLS rather than bounce. Walk the discovery the way a sending MTA does, with real dig, curl and openssl checks, and fix the first broken link.

15 April 2026 · 11 min read

Fix: multiple DMARC records

Two TXT records at _dmarc do not make DMARC stricter; they switch it off entirely, silently. Here is why RFC 7489 mandates that, the exact ways duplicates sneak into a zone, how to detect them and how to consolidate down to one correct record without losing your settings.

14 April 2026 · 11 min read

Fix: multiple SPF records

Two SPF records on one domain force a permanent PermError that silently strips a DMARC route. Here is why it happens, how receivers treat it, and how to merge two records into one compliant record without losing a sender or blowing the 10-lookup limit.

13 April 2026 · 11 min read

Fix: SPF TempError

An SPF TempError is a transient DNS failure, not a broken record. Here is what it means, why it differs from PermError, how Google, Yahoo and Microsoft treat it under SPF and DMARC, and the concrete steps that make your SPF resolution reliable.

12 April 2026 · 12 min read

Fix: SPF too many DNS lookups

SPF caps you at ten DNS-querying mechanisms, counted after every include expands into its provider's nested netblocks, which is why a record with five includes can spend fifteen lookups and PermError. Here is how to count the budget, prune the includes that overspend it, and flatten or consolidate back under the limit before enforcement makes the failure bite.