Mail Rx reference
The email toolbox
25 problems that account for most email support tickets, the usual cause of each, and the first thing to check. Below that are the free diagnostic tools professionals use, and the paid tools that can be worth buying.
If you have not run the checkup yet, start there instead of here. It reads your domain's live records and tells you which of these you actually have: Mail Rx checkup. This page is the reference you read when you already know which section you are in.
Delivery and reputation
Your mail leaves but does not arrive, or arrives in spam. The cause is almost always authentication.
| Symptom | Usual cause | First move |
|---|---|---|
| Mail lands in spam at Gmail and Yahoo | Missing or broken SPF, DKIM, or DMARC. Both providers now require authentication, and anyone sending volume is held to a DMARC policy minimum. | Run the checkup, fix SPF and DKIM first, then publish DMARC at p=none and read the reports before tightening. |
| Bounces mentioning 550 5.7.x or 'unauthenticated' | The same authentication gap, described from the receiving server's side. | Paste the bounce into the decoder. The specific 5.7 subcode names which check failed. |
| A new CRM or marketing tool's mail bounces | The tool sends as your domain but was never added to SPF, and its DKIM key was never turned on. | Add the vendor's SPF include, enable DKIM in the vendor's own settings, then send a test through mail-tester. |
| SPF worked, then broke after adding a vendor | SPF allows a maximum of ten DNS lookups. Each include counts, and vendors nest their own. | Count the includes. If you are near ten, flatten or consolidate senders rather than adding another. |
| Your domain or IP is on a blocklist | A compromised mailbox sent spam, or you inherited a reused IP from a shared sender. | Check the major lists, fix the underlying cause first, then use each list's own delisting form. Delisting before fixing gets you relisted. |
| Mail to one specific company always fails | Their filter dislikes something specific about your setup, or an old sending host of yours is still on a list. | Get the exact bounce from their side. Their postmaster address, not their help desk, is who can see the reason. |
Sudden and total
It worked yesterday. Something changed, and the date usually tells you what.
| Symptom | Usual cause | First move |
|---|---|---|
| All mail stopped for everyone at once | A DNS change, an expired domain, or a provider outage. | Check the provider status page first, then compare the domain's last-changed date against when it broke. |
| The domain expired | Auto-renew was off, or the card on file at the registrar expired. | Renew immediately, then set auto-renew and put the registrar's renewal notices somewhere a human reads them. |
| Mail broke right after a website change | Someone moved DNS to a new host and the MX records did not come along. | Compare current MX against what the mail provider says it should be. Web hosting moves are the most common cause of accidental mail deletion. |
| Mail broke after a security or password change | Every device holding a saved credential now fails, often silently, and some clients lock the account after repeated failures. | Sign out and back in on each device rather than retrying, and check whether the provider disabled legacy authentication at the same time. |
| Half your users are fine, half are broken | A change rolled out to one group, or two different mail systems are answering for the same domain. | Find what the two groups do not share: license type, client version, or which server their mailbox actually lives on. |
One person only
When it is one mailbox, the cause is inside the account, not in DNS.
| Symptom | Usual cause | First move |
|---|---|---|
| One person stopped receiving anything | A forwarding rule, a full mailbox, or quarantine holding their mail. | In the admin console, check rules, then quota, then quarantine, in that order. A rule someone set years ago is the usual answer. |
| Their mail is being read or answered by someone else | A compromised account, or a delegate or forward that was never removed. | Treat as a security incident: reset the password, revoke sessions, turn on MFA, then audit rules and forwards for what the intruder left behind. |
| Sent mail never appears in Sent Items | A client configured to send by SMTP without saving copies, or a rule moving them. | Check the account's send settings on the specific device, since this is nearly always one client misconfigured. |
| They get everything twice | The account is configured on the same device twice, or a forward loops back to the source mailbox. | Remove duplicate account entries first, then map the forwarding path end to end. |
| Shared mailbox or alias mail is missing | Someone converted a user mailbox to a shared one, or an alias points somewhere unexpected. | Confirm what the address actually is today. Aliases, groups, and shared mailboxes behave differently and get swapped during migrations. |
The client on the desk
Webmail works and the app does not. That narrows it to the device.
| Symptom | Usual cause | First move |
|---|---|---|
| Outlook keeps asking for a password | The work-or-school versus personal Microsoft account mix-up, or an expired session after a security change. | Sign fully out everywhere, then back in with the correct account type. This one problem accounts for a remarkable share of tickets. |
| Outlook shows old mail or will not send | Work Offline mode, a stale cache, or a damaged profile. | Check Work Offline first, then start with outlook.exe /safe to rule out add-ins, then rebuild the profile. |
| New Outlook behaves differently from the old one | They are different applications with different feature support, and the toggle is easy to flip by accident. | Confirm which one is running before troubleshooting anything else, because the fixes are not interchangeable. |
| Mac Mail quietly went offline | Apple Mail takes accounts offline on its own and does not make it obvious. | Mailbox menu, Take All Accounts Online. Then Window menu, Connection Doctor, which names the failing account. |
| iPhone stopped syncing but the laptop is fine | The account needs re-authentication on the device, or Fetch is set to manual. | Settings, Mail, Accounts to confirm sign-in, switch Fetch to Push, and remove and re-add the account if it still stalls. |
| Android stopped syncing in the background | Battery optimization killing the mail app, or sync disabled for that one account. | Exclude the mail app from battery optimization and confirm the account's sync toggle, before touching anything server side. |
Size, storage, and calendar
These are limits that look like failures.
| Symptom | Usual cause | First move |
|---|---|---|
| A large attachment will not send | Message size limits, commonly around 25 MB, and the encoded size is larger than the file on disk. | Send a link from OneDrive or Drive instead. Raise the limit only if you control both ends. |
| The mailbox is full and mail is bouncing | Quota reached, often from years of large attachments or an archive that was never set up. | Clear the largest items first, then set up archiving so it does not recur. Deleted Items and Sent count toward the quota. |
| Calendar invitations do not arrive or do not update | Invitations travel as mail, so a mail problem breaks the calendar, and duplicate calendar entries usually mean two accounts. | Fix mail flow first, then look for the same calendar subscribed twice on the device. |
Free diagnostic tools
Most email problems can be diagnosed with these free tools. They are third-party services with no affiliation to this site.
Microsoft
- Support and Recovery Assistant (SaRA) : runs Microsoft's own diagnostics for Outlook and account sign-in problems on Windows, and fixes many of them without you
- Remote Connectivity Analyzer : tests mail flow, autodiscover, and inbound SMTP from outside your network, which is the view your senders have
- Message Header Analyzer : paste raw headers and read the delivery path, the delays at each hop, and the authentication results decoded
- Admin Toolbox : Dig, CheckMX, and a header analyzer, maintained by the people who answer Workspace support tickets
- Postmaster Tools : shows how Gmail rates your domain's reputation and authentication, which matters once you send volume
- Email Log Search : inside the Workspace admin console: trace exactly what happened to one specific message
Apple
- Mail Connection Doctor : built into Apple Mail under the Window menu, and it names the failing account instead of making you guess
Vendor neutral
- mail-tester.com : send it one message and get a deliverability score with the specific reasons, free for a few tests a day
- MXToolbox : the standard record lookup and blocklist check, free for one-off queries
- dmarcian DMARC inspector : sanity-check a DMARC record's syntax before you trust it
- Let's Debug and DNS propagation checkers : confirm a record change is actually visible worldwide, rather than only in your own resolver's cache
When paying for a tool is worth it
Most of these solve a problem you can solve by hand, so the question is whether your time or your risk costs more than the subscription. Each one below says when it does and when it does not. Pricing moves constantly, so treat the cost notes as a range to check rather than a quote.
DMARC report processing
dmarcian, EasyDMARC, Valimail, Red Sift OnDMARC, Postmark's DMARC digests
- Worth it when: You published DMARC and the aggregate reports are arriving as unreadable XML, which is what always happens. A processor turns them into a list of who is sending as you.
- Skip it when: You have one mail provider, no marketing tools, and no plan to move past p=none. Read a few reports by hand instead.
- Cost shape: Several of these have a genuinely usable free tier for a single domain. Paid plans start low and scale by domain count and report volume.
Deliverability and inbox placement testing
GlockApps, mail-tester paid tiers, Litmus and Email on Acid for rendering
- Worth it when: You send campaigns or transactional volume and need to know whether you land in the inbox at each major provider before you send, not after.
- Skip it when: You send normal business mail person to person. The free single-message test answers the same question.
- Cost shape: Monthly subscriptions, and the rendering testing suites cost meaningfully more than the placement checkers.
Monitoring and alerting
MXToolbox monitoring, UptimeRobot, Healthchecks, DNS change monitoring services
- Worth it when: You want to hear about an expired domain, a changed MX, or a blocklist entry from a monitor rather than from your customers. This is the highest-value paid tier for most small businesses.
- Skip it when: Nothing about your setup changes and someone already watches the provider status page.
- Cost shape: Free tiers cover basic uptime checks. Mail-specific and blocklist monitoring is a modest monthly cost, and it is cheap next to one silent outage.
Advanced filtering and security add-ons
Microsoft Defender for Office 365, Google Workspace security tiers, third-party mail gateways
- Worth it when: You have been phished successfully, you handle money or client data, or an insurer or client is asking what protections exist.
- Skip it when: The built-in filtering has never failed you and MFA is not turned on yet. Turn on MFA first, since it prevents more damage than any add-on.
- Cost shape: Per user per month, and it stacks up quickly across a whole company. Price the licence tier rather than the add-on in isolation.
Migration and archiving tools
BitTitan MigrationWiz, CodeTwo, provider-native import tools
- Worth it when: You are moving more than a handful of mailboxes, or you need calendars, permissions, and shared mailboxes to survive the move intact.
- Skip it when: It is one or two mailboxes. The provider's own free import will do it, slowly.
- Cost shape: Usually priced per mailbox as a one-time licence, which is almost always cheaper than the hours a manual migration takes.
When to stop and get help
- Mail is down for the whole company and you are not certain which record changed.
- You suspect a mailbox was compromised. Speed matters more than diagnosis, and the cleanup after is what people miss.
- You are about to edit DNS on a domain you did not set up and cannot see the previous values.
- A migration is scheduled and nobody has written down what happens to shared mailboxes, aliases, and calendar permissions.
Want a second pair of eyes on any of it? hello@steverolfe.co.
This page is general diagnostic guidance, not a guarantee, and it cannot see your environment. Before editing DNS: change one record at a time, write down what it said before, and give changes up to an hour before judging the result. Changes you make to your own systems are your responsibility. When mail is business-critical and the fix is unclear, have a professional look before you change anything. The tools named here are independent third parties with no affiliation, and their features and pricing change without notice.