DNS & Email Deliverability Guides

Guides for DNS records, propagation delays, and email deliverability — NXDOMAIN, SPF/DKIM/DMARC, MX, nameservers, and blacklists. Each guide includes a free check for your domain.

DNS — 44 guides

523 Origin Is Unreachable (Cloudflare) Fix

Cloudflare 523 means Cloudflare can't route to your origin's IP. Fix it in 3 checks: stale A record, dead origin, routing. Free instant check, no sign-up.

550 5.1.1 User Unknown: Recipient Doesn't Exist

550 5.1.1 User Unknown means the mailbox doesn't exist, not SPF. Pin the cause in 3 checks: the address, MX routing, aliases. Free instant check, no sign-up.

550 5.4.1 Recipient Address Rejected: Access Denied

550 5.4.1 Recipient Address Rejected means a directory block, not SPF. Pin the cause in 3 checks: recipient, DBEB, relay. Free instant check, no sign-up.

550 5.7.1: Fix SPF and Policy Rejection Bounces

550 5.7.1 means the receiver permanently refused your mail on policy — usually SPF. Pin down which of 4 causes in 5 checks. Free instant check, no sign-up.

550 5.7.23: Fix the SPF Check Failed Bounce

550 5.7.23 means a receiver rejected your mail because its sending IP failed your SPF record. Fix it in 3 checks: SPF, the IP, and -all. Free instant check.

550 5.7.25: Fix Gmail's Reverse DNS (PTR) Rejection

550 5.7.25: Gmail rejected your mail — the sending IP's PTR is missing or mismatched. Check PTR, forward match, and FCrDNS. Free instant check, no sign-up.

550 5.7.26: Fix Gmail's Unauthenticated Email Block

550 5.7.26 means Gmail blocked your mail as unauthenticated. Fix it in 4 checks: SPF, DKIM, DMARC, and From alignment. Free instant check, no sign-up.

550 5.7.350 Remote Server Returned Message Detected as Spam

550 5.7.350 means a recipient server flagged your outbound mail as spam. Fix it in 3 checks: SPF, DKIM, and DMARC on your sending domain. Free instant check.

550 5.7.509: Fix Microsoft's DMARC Reject Bounce

550 5.7.509 means Microsoft enforced your own p=reject policy on unaligned mail. Fix alignment in 4 checks: SPF, DKIM, DMARC. Free instant check, no sign-up.

552 5.2.2 Mailbox Full / Over Quota: Fix

552 5.2.2: the recipient's mailbox is over quota, not your SPF or DKIM. Tell permanent from temporary and who must fix it. Free instant check, no sign-up.

554 5.7.1 Relay Access Denied: Fix the Bounce

554 5.7.1 Relay Access Denied means a server refused to forward your mail. Find why in 3 checks: auth, MX, allowed senders. Free instant check, no sign-up.

A/AAAA Record Troubleshooting Checklist

A record not resolving? Fix missing or wrong A/AAAA records in 5 steps: values, TTL, delegation, propagation, IPv6. Free instant DNS check, no sign-up.

CDN Cache vs DNS Propagation

Changes not visible after a DNS update? Check resolver answers first, then CDN cache headers, then purge or wait out TTL. Free instant check, no sign-up.

CNAME vs A Record — When to Use Which

CNAME vs A record: what each does, when to use which, and the apex domain rule that breaks naive setups. Free instant DNS lookup, no sign-up.

DKIM Selector Not Found: dkim=none and Missing Key

DKIM selector not found means receivers can't fetch your key. Check the s= selector, CNAME delegation, and typos in 4 steps. Free instant check, no sign-up.

DKIM Verification Failed: dkim=fail and Body Hash Mismatch

Why a correctly signed email still fails DKIM — body hash mismatch, missing selector, revoked key, and DMARC alignment — and how to find the real cause.

DMARC none vs quarantine vs reject: Which Policy to Use

DMARC none vs quarantine vs reject: what each policy does and a 3-stage rollout to reach reject safely. Free instant DMARC record check, no sign-up.

DNS Propagation Delay: Why Changes Take Time to Appear

DNS propagation delay or cache? Separate TTL, resolver cache, and CDN caching in 3 checks across regions. Free instant propagation check, no sign-up.

DNS REFUSED: Fix the Policy Block Response

DNS REFUSED means a server won't answer you on purpose — wrong nameserver, no recursion, or an ACL. Find which in 4 checks. Free instant check, no sign-up.

DNS SERVFAIL: Fix Server Failure Responses

DNS SERVFAIL means the resolver tried and failed — usually DNSSEC or a dead nameserver. Split the cause in 4 checks. Free instant check, no sign-up.

DNS TTL Best Practices — Optimal Values for Every Scenario

DNS TTL best practices: recommended values for stable records, failover, and migrations. Free instant DNS check shows your current TTLs, no sign-up.

DNS_PROBE_FINISHED_BAD_CONFIG Fix

DNS_PROBE_FINISHED_BAD_CONFIG in Chrome? Confirm the domain resolves publicly, then fix the local resolver, cache, or router. Free instant check, no sign-up.

DNS_PROBE_FINISHED_NO_INTERNET Fix

DNS_PROBE_FINISHED_NO_INTERNET in Chrome? Confirm the site resolves publicly, then isolate your network, resolver, or VPN. Free instant check, no sign-up.

DNS_PROBE_FINISHED_NXDOMAIN Fix Checklist

DNS_PROBE_FINISHED_NXDOMAIN? Fix it in 4 checks: DNS records, nameserver delegation, resolver cache, domain status. Free instant check, no sign-up.

DNSSEC Validation Failed: Fix the SERVFAIL

DNSSEC validation failed? SERVFAIL from expired RRSIG, a missing DS, or a bad key rollover. Find the broken link in 5 checks. Free instant check, no sign-up.

Email Going to Spam? SPF, DKIM, and DMARC Setup

Emails going to spam? Set up SPF, DKIM, and DMARC in 3 steps with copy-paste DNS records. Free instant check shows what's missing, no sign-up.

ERR_ICANN_NAME_COLLISION: Fix the Chrome DNS Error

ERR_ICANN_NAME_COLLISION means a name resolved to 127.0.53.53. Check the name, your search domain, and if the TLD is public. Free instant check, no sign-up.

ERR_NAME_NOT_RESOLVED Fix

ERR_NAME_NOT_RESOLVED means DNS couldn't turn the hostname into an IP. Tell a dead domain from a broken resolver in 3 checks. Free instant check, no sign-up.

Error 1000 DNS Points to Prohibited IP (Cloudflare)

Error 1000: your Cloudflare DNS record points at a Cloudflare IP, not your origin. Find the looping A record in 3 checks. Free instant check, no sign-up.

Error 1001 DNS Resolution Error (Cloudflare): Fix

Error 1001 means Cloudflare can't map the requested hostname to a zone. Fix in 3 checks: the DNS record, a dangling Cloudflare IP, propagation. Free instant check, no sign-up.

Error 1014 CNAME Cross-User Banned (Cloudflare)

Error 1014 means your CNAME crosses two Cloudflare accounts and is banned. Check the target, swap to an A record, or use SaaS. Free instant check, no sign-up.

Error 1016 Origin DNS Error (Cloudflare): Fix

Error 1016 means Cloudflare can't resolve your origin's IP. Fix in 3 checks: A/AAAA record, CNAME target, origin host. Free instant check, no sign-up.

Error 530 (Cloudflare): Read the 1xxx Code Inside

Error 530 from Cloudflare is a wrapper, not the error. Find the 1xxx code in the page body, decode it, and fix the origin. Free instant check, no sign-up.

Mail Server Blacklist Removal Checklist

Mail server blacklisted? Run 3 checks before requesting delisting: sending hygiene, abuse review, RBL-specific cleanup. Free instant check, no sign-up.

MTA-STS and TLS-RPT Setup: Enforce SMTP TLS

MTA-STS setup: publish the TXT, host the policy over HTTPS, add TLS-RPT, and start in testing before you enforce. Free instant check, no sign-up.

MX/SPF/DMARC Basic Checks

Email not delivering? Check MX, SPF, DKIM, and DMARC in 4 steps to separate delivery failures from spam filtering. Free instant check, no sign-up.

Nameserver Mismatch Diagnosis

Nameserver mismatch breaks DNS silently. Compare registrar NS records with the zone's actual servers and fix delegation. Free instant check, no sign-up.

NET::ERR_ADDRESS_UNREACHABLE: No Route to Host

NET::ERR_ADDRESS_UNREACHABLE means there is no network route to the resolved IP, usually a broken IPv6 AAAA record. Check A vs AAAA and reachability in 3 steps. Free instant check.

No MX Record: Email Not Delivering

No MX record means inbound mail has nowhere to land. Check MX presence, priority, the A-record fallback, and null MX in 5 steps. Free instant check, no sign-up.

Reverse DNS / PTR Setup Guide

PTR record missing? Mail servers may reject you. Set reverse DNS with your IP provider and match your sending hostname. Free instant check, no sign-up.

SMTP Port 25 Blocked: Why It Happens and the Fix

SMTP port 25 blocked usually means your ISP or cloud host bars outbound mail. Tell the cases apart and move to 587/465 in 4 checks. Free instant check, no sign-up.

SPF Permerror: Too Many DNS Lookups

SPF permerror? Get under the 10 DNS lookup limit in 3 steps: count lookups, flatten includes, drop dead mechanisms. Free instant check, no sign-up.

Subdomain Takeover: Find Dangling DNS Records

Subdomain Takeover: a CNAME points to a deprovisioned cloud resource anyone can re-register. Spot dangling DNS in 4 checks. Free instant check, no sign-up.

TXT Record Over 255 Characters: Split It Right

TXT record over 255 characters fails because each string caps at 255 bytes. Split it into quoted chunks the right way in 4 checks. Free instant check, no sign-up.