Complete SPF record setup guide, including syntax explanation and best practices
Configure DANE for SMTP with TLSA records to enforce secure delivery
Set up MTA-STS policy with Cloudflare for secure SMTP delivery
"Email is broken" rarely has one cause. Deliverability depends on four independent layers, and a failure in any of them looks identical from the recipient's side: the message does not arrive. Checking them in the wrong order wastes hours, so this guide works from the bottom up.
Before touching authentication, confirm the basics resolve. A missing or wrong MX record means inbound mail fails regardless of how perfect your SPF is, and a typo here is far more common than a DNSBL listing.
This is the layer most guides start with, and it is where SPF, DKIM and DMARC are decided. Check each one separately before checking the combination:
A message can pass SPF and DKIM and still fail DMARC, because DMARC evaluates alignment rather than raw pass. Paste a real message into the Header Analyzer to see what actually happened rather than what you intended.
Authentication proves the message is yours. It does not prove your IP has a good reputation. Check the sending IP against public blocklists with the Blacklist Checker. A listing is not always fatal — many receivers weight it alongside authentication and complaint history — but an unexplained listing on a shared host is worth fixing before it spreads.
Once the technical layers are clean, remaining failures are usually about what the message contains or how it is sent: a new domain with no sending history, a sudden volume spike, a link shortener, an image-only email, or a list that has not been cleaned in a year. Test placement across providers rather than a single inbox, and note that one provider filtering you is a reputation signal, not necessarily a broken record.
The Email Health check runs the DNS and authentication layers in one pass, and the Deliverability Test covers placement across providers.
Always the lowest one that fails. Fixing DKIM when MX is wrong changes nothing. Fixing authentication when the IP is listed produces correctly signed mail that is still rejected.
Weekly for a domain that sends regularly, and after every change to DNS, hosting or sending tools. A green result today says nothing about next month.
Authentication is not a reputation guarantee. Look at volume patterns, list quality, complaint rate and content. A brand-new domain sending a large first batch fails on history alone, no matter how correct the records are.
