Troubleshooting mail that does not arrive or lands in spam

When a message does not arrive, or arrives in a recipient's spam folder, work through the checks below in order. Most delivery problems come from authentication records, a DMARC policy the message does not align with, or a sending address that a receiving server has already decided to distrust.

1. Read the headers

Ask the recipient for the original message, either as an attachment or from the raw source view, not a copy of the body. Look for the Authentication-Results header that the receiving server added:

Authentication-Results: mx.recipient.example; spf=pass smtp.mailfrom=you@example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com

Each of spf, dkim and dmarc should read pass. A fail, softfail, neutral or none on any of them points to the section that needs work.

2. Check SPF

SPF is a TXT record on the domain in the envelope sender (the Return-Path) that lists which servers may send mail for that domain. For a domain that sends through ITProMail, the record must include the ITProMail include:

example.com. IN TXT "v=spf1 include:_spf.itpromail.com -all"

Check what is published:

dig +short TXT example.com

A domain may have only one SPF record; two records produce a permanent failure, so merge other senders into it. Use -all in production and ~all only while testing. SPF allows at most 10 DNS lookups, so long include chains can break it.

3. Check DKIM

Outgoing mail is signed with selector itpro1. A custom domain publishes a CNAME that points to the ITProMail key:

itpro1._domainkey.example.com. IN CNAME itpro1._domainkey.itpromail.com.

dig +short CNAME itpro1._domainkey.example.com

Check the DKIM-Signature header in a received message. The d= value should be your domain. A signature made for a different domain can pass DKIM while failing DMARC alignment.

4. Check DMARC

dig +short TXT _dmarc.example.com

DMARC passes when SPF or DKIM passes and the authenticated domain matches the domain in the From: header. A message that passes SPF for an unrelated bounce domain still fails DMARC. For background, see SPF, DKIM and DMARC explained. To read the reports receivers send back, see DMARC reports.

5. Check reverse DNS

Reverse DNS (PTR) matters for servers that connect directly to yours. Mail submitted through ITProMail comes from ITProMail's addresses, so this check applies only if you run your own sending host. Forward and reverse must agree: the PTR name must resolve back to the same address.

dig -x 203.0.113.25 +short

6. Check blocklists

Look up the sending IP and the sending domain in public DNS blocklists. An IP listing concerns the address; a domain listing concerns the domain's reputation. Each list has its own removal process, and requesting removal without fixing the cause rarely helps. Common causes are a compromised password, spam sent from the account, a phishing link in a message, or a sudden burst to unknown addresses. See sending limits.

7. Check the content and the recipient side

• Ask the recipient to mark a legitimate message as not spam and to add your address to their contacts or allow list. Filtering happens on the recipient's side, and you cannot override it from here.
• If the recipient is on your own account, check Sieve filters for rules that file mail away.

When to contact support

If SPF, DKIM and DMARC all pass and the message still does not arrive, contact support@itpromail.com. Include the full headers with any personal content removed, the send time in UTC, and the recipient domain. Never include your password or an app password.