Email is not arriving

Sending or receiving?

These are two separate problems with separate causes, so be clear which one you have.

• Your mail isn't reaching other people. It bounces back, or they say it never came, or it lands in their spam. That is usually about how your domain proves you are allowed to send.
• Other people's mail isn't reaching you. They get a bounce, or nothing happens at all. That is usually about where your domain says mail should be delivered.

Read the bounce

A bounce is the "undeliverable" or "delivery failure" email that comes back to you. Somewhere in it is a three digit code, often followed by a longer one such as 550 5.7.1. A code starting with 5 is a permanent refusal. A code starting with 4 is temporary and the sending server will keep trying for a while.

Or skip the reading: paste the whole bounce into the bounce explainer and it tells you what went wrong and what to do.

The four records that decide where mail goes

All four live in your domain's DNS, wherever that is managed. Your mail provider tells you exactly what each should contain.

1. MX: where your mail is delivered

   Points at the servers that accept mail for your domain. If you have moved to a new mail provider and these still point at the old one, mail keeps going there.

2. SPF: who may send as you

   A text record starting v=spf1 that lists the services allowed to send mail from your domain. Every service that sends as you needs to be in it: your mailboxes, your newsletter tool, your booking system, your website.

3. DKIM: a signature on each message

   Your mail provider signs each message, and publishes the key to check the signature in your DNS. Receiving servers use it to confirm the message wasn't forged or altered on the way.

4. DMARC: what to do when the checks fail

   A text record at _dmarc on your domain. It tells receiving servers whether to accept, quarantine or reject mail that fails, and where to send reports. Start with a policy of none and tighten it once the reports show your own mail passing.

Put together, they look something like this. The names are examples; yours come from your provider.

example.co.uk.         MX   10 mail.provider.example.
example.co.uk.         TXT  "v=spf1 include:spf.provider.example ~all"
_dmarc.example.co.uk.  TXT  "v=DMARC1; p=none; rua=mailto:reports@example.co.uk"

Gmail and Microsoft's consumer mail now junk or refuse a great deal of mail that fails these checks, and they require large senders to have all three of SPF, DKIM and DMARC. A small business that never set them up can find its mail quietly going to spam.

Only ever one SPF record

The commonest single mistake. A new service tells you to "add this SPF record", so a second record starting v=spf1 appears beside the first. Two is an error, and receiving servers treat the whole check as failed. Merge them into one record instead. The SPF merger does it for you, and can start from the records your domain has now.

There is also a limit on how many other services one SPF record can refer to, ten lookups in all. A record that has grown over the years can pass that limit without anybody noticing.

Mail from your website's contact form

A contact form often sends its message from the web server, using your domain as the sender. The web server isn't in your SPF record and doesn't sign with your DKIM key, so the message looks forged and lands in spam, or disappears.

The fix is to make the website send through your real mail provider, using a proper login, or through a sending service that is included in your SPF record and signs its mail. WordPress has well known plugins for the first.

Mail that isn't reaching you

• Check the MX records point at the provider you use now. After a move they are often left pointing at the old one.
• Check spam and quarantine. Microsoft 365 holds suspect mail in a quarantine that isn't your junk folder, and it has to be looked at separately.
• Check the mailbox isn't full.
• Check for rules you didn't create. A mailbox that has been broken into often gets a rule that forwards or deletes incoming mail, so that the owner doesn't notice. If you find one, change the password and turn on two step sign in straight away.

Checking the records yourself

These work in the Command Prompt on Windows and the Terminal on a Mac. Put your own domain in place of the example.

nslookup -type=mx example.co.uk
nslookup -type=txt example.co.uk
nslookup -type=txt _dmarc.example.co.uk

The first shows where mail is delivered. The second shows the SPF record among any others, and you are looking for exactly one line containing v=spf1. The third shows the DMARC record, if there is one.