← Back to Email not sending

Likely fix

Fix: Email rejected because of SPF, DKIM, or DMARC

SPF, DKIM, and DMARC errors mean the receiving server could not verify that your email was allowed to send from your domain.

Quick answer

Check your domain DNS records for SPF, DKIM, and DMARC. Make sure your email provider is included in SPF and that DKIM is enabled by your provider.

Important warning

Do not create multiple SPF records for the same domain. Multiple SPF TXT records can break SPF.

Try this

  1. 1 Read the bounce message and confirm it mentions SPF, DKIM, or DMARC.
  2. 2 Identify which email provider sends mail for your domain.
  3. 3 Check your domain's SPF record.
  4. 4 Make sure the sending provider is included in SPF.
  5. 5 Enable DKIM signing in your email provider if available.
  6. 6 Add or check your DMARC record.
  7. 7 Wait for DNS changes to propagate.
  8. 8 Send a test email after the records update.

Common causes

Email provider is missing from SPF.

Multiple SPF records exist.

DKIM is not enabled.

DMARC policy is too strict for current setup.

Email is being sent through a website, app, or server not authorized in DNS.

What to check next

  • Check whether there is exactly one SPF record.
  • Check whether your email provider gives DKIM records.
  • Check whether your website sends email from the same domain.
  • Check whether DMARC policy is rejecting unauthenticated mail.
  • Check whether DNS changes have had time to update.

FAQ

What are SPF, DKIM, and DMARC?

They are email authentication systems that help prove your domain is allowed to send the email.

Can SPF, DKIM, or DMARC stop email sending?

They can cause sent emails to be rejected or delivered to spam if your domain's DNS records are wrong.

Should I have more than one SPF record?

No. A domain should normally have one SPF TXT record that includes all authorized senders.

Related fixes