Guides
Plain-English fixes for the exact errors that page you at 2am — each with the diagnosis tool built in.
- Fixing "550 5.7.515 Access denied" from Microsoft
550 5.7.515 Access denied, sending domain does not pass DMARC verification
Microsoft 365 rejects mail from domains without aligned authentication. Here is what the bounce means and the exact records to publish.
- SPF PermError: too many DNS lookups
SPF PermError: too many DNS lookups
SPF stops evaluating after 10 DNS lookups. Over the limit, receivers treat your SPF as broken. How to count, flatten and fix it.
- "550 5.7.1 rejected — listed at Spamhaus": getting delisted
550 5.7.1 Service unavailable, client blocked using Spamhaus
What a Spamhaus listing means (ZEN, SBL, XBL, PBL), how to find the real cause, and how to delist without bouncing back.
- Listed on the Barracuda Reputation Block List (BRBL)
550 permanent failure ... listed on b.barracudacentral.org
Barracuda appliances sit in front of a huge share of business mailboxes. What a BRBL listing means and the free delisting path.
- Gmail "550-5.7.26 unauthenticated email" rejections
550-5.7.26 This mail has been blocked because the sender is unauthenticated
Gmail requires SPF or DKIM at minimum — and both, aligned, for bulk senders. Decoding 5.7.26 and meeting Google's rules.
- "Your connection is not private" — an expired TLS certificate
NET::ERR_CERT_DATE_INVALID / certificate has expired
What actually breaks when a certificate expires, why auto-renewal fails silently, and how to renew and never repeat it.
- Fixing "dkim=fail (body hash did not verify)"
dkim=fail (body hash did not verify) header.d=example.com
A valid DKIM signature that still fails means something rewrote the message in transit. Here is what changes the body hash and how to stop it.
- What "Received-SPF: softfail" means (and why mail still lands in spam)
Received-SPF: softfail (domain of example.com does not designate 203.0.113.9 as permitted sender)
Softfail is SPF saying "probably not authorized". It rarely bounces but quietly hurts deliverability. Here is how to make it a clean pass.
- Fixing Yahoo "554 5.7.9 Message not accepted for policy reasons"
554 5.7.9 Message not accepted for policy reasons
Yahoo and AOL enforce the same bulk-sender rules as Gmail. This bounce means authentication or list hygiene fell short — here is the checklist.
- Fixing "MX record refers to a host with no address record"
MX record points to a host that has no A or AAAA record
An MX that resolves to nothing means inbound mail fails at the door. Here is how to spot the broken target and repair it.
- Fixing "NET::ERR_CERT_COMMON_NAME_INVALID"
NET::ERR_CERT_COMMON_NAME_INVALID / SSL_ERROR_BAD_CERT_DOMAIN
The certificate is valid but does not cover the name you visited. Here is why the SAN list matters and how to fix the mismatch.
- Fixing "TLS negotiation failed" reported against your MTA-STS policy
TLS-RPT: failure — certificate.host.mismatch / starttls.not.supported
Once you publish MTA-STS in enforce mode, a broken TLS setup blocks inbound mail. Here is how to read the failure reports and fix them.
- Fixing "550 5.7.606 Access denied, banned sending IP" from Microsoft
550 5.7.606-608 Access denied, banned sending IP [x.x.x.x]
Microsoft blocked your sending IP for reputation, not a DNS mistake. What the 5.7.606-608 codes mean and how to get delisted for good.
- Fixing the Outlook.com block: "messages weren’t sent" (S3140 / S3150)
Unfortunately, messages from x.x.x.x weren’t sent. S3150
Outlook.com is refusing your mail for reputation reasons. What the S3140/S3150 codes mean and how to request mitigation.
- Fixing Gmail "421 4.7.28 unusual rate of unsolicited mail"
421-4.7.28 Gmail has detected an unusual rate of unsolicited mail
Gmail is temporarily deferring your mail for volume or reputation. What 4.7.28 means and how to stop the throttling.
- Listed on UCEPROTECT: should you worry, and how to delist
x.x.x.x is listed by dnsbl-2.uceprotect.net
UCEPROTECT Level 2/3 list entire ranges and push paid delisting. What the levels mean and why most providers ignore them.
- Fixing "550 5.7.23 SPF validation failed"
550 5.7.23 the sending domain does not designate the server as a permitted sender
The receiver rejected your mail because SPF fails. How to authorize the right servers and stay under the 10-lookup limit.
- Fixing "550 5.7.25" reverse DNS (PTR) rejections
550 5.7.25 the sending IP does not have a PTR record / reverse DNS
Receivers reject mail from IPs without valid reverse DNS. How to set a PTR record and make forward-confirmation pass.
- Fixing "spf=none" and "dkim=none": missing email authentication
Authentication-Results: spf=none; dkim=none; dmarc=none
spf=none/dkim=none means the records are missing entirely. How to publish SPF, DKIM and DMARC from scratch.
- Fixing SERVFAIL from DNSSEC validation failures
SERVFAIL — DNSSEC validation failed (bogus)
A broken DNSSEC chain makes your whole domain unresolvable to validating resolvers. How to find and fix the mismatch.
- Fixing "550 5.1.1 User unknown / no such user"
550 5.1.1 Recipient address rejected: user unknown
A 5.1.1 bounce means the recipient mailbox does not exist. How to tell a typo from a dead address and protect your reputation.
- Fixing "4.4.7 message expired" / retry timeout exceeded
4.4.7 message expired: retry time exceeded / delivery time expired
Your server retried for hours and gave up. What 4.4.7 says about the destination and how to confirm reachability.