Troubleshoot email delivery problems

“Email is not working” is five different problems wearing one trench coat: rejection, delay, missing inbound mail, spam-folder placement, or an application that never sent anything at all. Pick one affected message and follow it end to end before touching DNS or content — that message will tell you which problem you actually have.

Classify the failure

Record sender, recipient, timestamp with time zone, subject, message ID, sending system, and whether other recipients were affected.

• A 5xx SMTP code is a permanent failure for that attempt.
• A 4xx code is temporary; the sending system should retry according to its policy.
• “Sent” in an application may only mean the request entered a queue.
• Spam placement means the receiving system accepted the message but classified it.

Preserve the complete bounce or provider trace.

Check whether the application sent

Inspect application logs, job queues, provider API responses, suppression lists, rate limits, and verified-sender settings. Confirm the From and envelope-from values. Retry only after understanding whether the original is queued; duplicate transactional email can be harmful.

Verify incoming routing

For missing inbound mail, query MX records:

dig example.com MX +short

Confirm the targets match the current provider and that the provider is configured to accept the domain and recipient. Check domain status and nameserver delegation when records unexpectedly disappear.

Inspect authentication

For a delivered message, open full headers and review Authentication-Results. Check SPF, DKIM, and DMARC results and alignment. For a rejection, compare the error with DNS:

dig example.com TXT +short
dig selector1._domainkey.example.com TXT +short
dig _dmarc.example.com TXT +short

Ensure SPF includes every legitimate sender and does not exceed its lookup limit. Confirm DKIM signing is enabled after publishing the key. Review DMARC reports for affected sources.

Investigate reputation and policy

If authentication passes but mail is throttled or placed in spam, review complaint rate, invalid recipients, sudden volume changes, engagement, list acquisition, and provider reputation dashboards. Use separate streams or subdomains where the business needs operational isolation, but do not use them to evade policy.

Make unsubscribe and preference controls clear for marketing mail. Send only expected content to consenting recipients.

Check message construction

Validate headers, MIME structure, text and HTML parts, links, attachments, encoding, and From/Reply-To behavior. Avoid URL shorteners, misleading display names, or domains that redirect unexpectedly. Confirm the landing domain is secure and not compromised.

Escalate with complete evidence

Provide the mail provider with message ID, timestamps, full SMTP response, headers, source IP, authenticated domains, and affected recipients. Redact message content and personal data where possible, but do not omit the routing evidence required for diagnosis.

After fixing the cause, send a controlled test, confirm authentication and delivery, and monitor recurrence. Update the sender inventory and change process.

Sources and further reading

• RFC 5321: Simple Mail Transfer Protocol
• Google Workspace: Troubleshoot SPF issues
• Google Workspace: Email sender guidelines