Likely fix
Fix: Email rejected because of SPF, DKIM, or DMARC
SPF, DKIM, and DMARC errors mean the receiving server could not verify that your email was allowed to send from your domain.
Quick answer
Check your domain DNS records for SPF, DKIM, and DMARC. Make sure your email provider is included in SPF and that DKIM is enabled by your provider.
Important warning
Do not create multiple SPF records for the same domain. Multiple SPF TXT records can break SPF.
Try this
- 1 Read the bounce message and confirm it mentions SPF, DKIM, or DMARC.
- 2 Identify which email provider sends mail for your domain.
- 3 Check your domain's SPF record.
- 4 Make sure the sending provider is included in SPF.
- 5 Enable DKIM signing in your email provider if available.
- 6 Add or check your DMARC record.
- 7 Wait for DNS changes to propagate.
- 8 Send a test email after the records update.
Common causes
Email provider is missing from SPF.
Multiple SPF records exist.
DKIM is not enabled.
DMARC policy is too strict for current setup.
Email is being sent through a website, app, or server not authorized in DNS.
What to check next
- Check whether there is exactly one SPF record.
- Check whether your email provider gives DKIM records.
- Check whether your website sends email from the same domain.
- Check whether DMARC policy is rejecting unauthenticated mail.
- Check whether DNS changes have had time to update.