On this page
If you need to fix mail delivery, start by checking email authentication, DNS records, the sending server’s hostname and reverse DNS, SMTP configuration, and sender reputation. SPF, DKIM, and DMARC are three important parts of this process, but they do not solve every delivery problem by themselves.
A message can pass SPF and DKIM and still land in spam because of poor reputation, incorrect DNS, suspicious content, high complaint rates, or server configuration problems.
This guide explains how to set up SPF, DKIM, and DMARC, verify them, troubleshoot common failures, and improve the chances of your messages reaching the inbox.
Important: DNS values depend on your mail provider. Do not copy another provider’s SPF or DKIM record blindly. CyberPanel’s current documentation has different DNS requirements for its self-hosted mail setup and CyberMail services.
Why Is Your Email Not Being Delivered?
Before changing DNS records, identify what is actually failing.
Email delivery problems usually fall into one of these categories:
| Problem | Possible cause |
|---|---|
| Email is rejected immediately | Authentication, DNS, SMTP, IP reputation, or policy issue |
| Email goes to spam | Reputation, authentication, content, or recipient filtering |
| SPF fails | Missing, incorrect, or conflicting SPF record |
| DKIM fails | Missing key, incorrect selector, or invalid signature |
| DMARC fails | SPF/DKIM alignment or authentication problem |
| Emails are delayed | Greylisting, reputation, DNS, or receiving-server throttling |
| SMTP authentication fails | Incorrect credentials or SMTP configuration |
| Receiving mail fails | Incorrect MX records or mail server configuration |
| Some providers reject mail | Provider-specific reputation or authentication requirements |
Start with the actual error message whenever possible.
A bounce such as 550, 554, or 5.7.x can provide much more useful information than simply knowing that an email did not arrive.
What Should You Check First to Fix Mail Delivery?
Use this order when troubleshooting:
- Confirm the sending domain.
- Check the MX record if receiving mail is affected.
- Check SPF.
- Check DKIM.
- Check DMARC.
- Check SPF and DKIM alignment.
- Check the sending server’s hostname.
- Check reverse DNS or PTR.
- Check SMTP authentication and TLS.
- Check the mail server logs and queue.
- Check IP and domain reputation.
- Send a test message and inspect its headers.
This prevents you from changing several settings at once without knowing which change fixed or caused the problem.
What Are SPF, DKIM, and DMARC?
SPF, DKIM, and DMARC solve different parts of email authentication.
| Technology | What it verifies | DNS record |
|---|---|---|
| SPF | Which servers are authorized to send for a domain | TXT |
| DKIM | Whether a message carries a valid cryptographic signature | TXT |
| DMARC | Whether SPF or DKIM authentication aligns with the visible From domain | TXT |
SPF identifies authorized sending infrastructure.
DKIM adds a cryptographic signature to outgoing messages.
DMARC tells receiving servers how to handle messages that fail authentication and provides reporting capabilities. DMARC also uses identifier alignment between the visible From: domain and the authenticated SPF or DKIM domain.
These systems work together rather than replacing one another.
How Do You Set Up SPF to Fix Mail Delivery?
SPF, or Sender Policy Framework, is published as a TXT record in your domain’s DNS.
The record identifies the servers or services authorized to send mail for your domain.
A simple example for a server that sends directly from its own IP might look like:
v=spf1 ip4:203.0.113.10 ~allReplace the example IP with your actual sending IP.
If your provider gives you an SPF include, use the provider’s value instead.
For example, CyberPanel’s current CyberMail documentation uses:
v=spf1 include:spf.cyberpersons.com ~allfor its CyberMail services.
Why Should You Have Only One SPF Record?
A common mistake is creating multiple SPF TXT records for the same domain.
For example:
v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.cyberpersons.com ~allThis is incorrect.
Instead, authorized services should be combined into one SPF record:
v=spf1 include:_spf.google.com include:spf.cyberpersons.com ~allCyberPanel’s current troubleshooting documentation specifically warns that domains should have one SPF record and that multiple providers should be merged into a single record.
How Many SPF DNS Lookups Are Allowed?
SPF has a limit of 10 DNS-query-causing mechanisms during evaluation. Exceeding this limit can result in a permanent SPF error.
This becomes a problem when a domain authorizes several email providers through multiple include, a, mx, ptr, or exists mechanisms.
If your SPF record becomes complicated, simplify it rather than continually adding providers.
How Do You Set Up DKIM to Fix Mail Delivery?
DKIM, or DomainKeys Identified Mail, uses public-key cryptography to sign outgoing email.
The sending server keeps the private key.
The public key is published in DNS.
A receiving server can then retrieve the public key and verify the signature.
A DKIM record normally looks like:
selector._domainkey.example.comThe exact selector and public key depend on your mail server or email provider.
How Do You Get the DKIM Record in CyberPanel?
For current CyberPanel email management, open the Email section and use DKIM Manager to obtain the domain’s DKIM record.
CyberPanel’s current Email Management documentation specifically instructs users to use DKIM Manager for the domain’s DKIM record.
The older CyberPanel DKIM documentation also explains that DKIM keys can be generated through the DKIM Manager.
Do not manually invent a DKIM public key.
Copy the value generated by your actual mail server.
How Do You Add a DKIM Record to DNS?
Your DNS provider normally requires:
| Field | Example |
|---|---|
| Type | TXT |
| Name | selector._domainkey |
| Value | Your generated DKIM public key |
| TTL | Default or provider recommendation |
For CyberMail, the current CyberPanel documentation gives different selectors depending on the service. Hosted domains use a mail selector, while sending-only domains use a postal selector.
That is why you should always copy the DKIM record from the actual dashboard rather than assuming the selector.
How Do You Set Up DMARC?
To setup DKIM DMARC records, you need to publish the correct authentication records in your domain’s DNS and make sure they match the systems that send email for your domain.
DMARC, or Domain-based Message Authentication, Reporting and Conformance, is published as a TXT record at:
_dmarc.example.comA basic monitoring policy can look like:
v=DMARC1; p=none; rua=mailto:[email protected]This tells receiving systems to monitor DMARC results without requesting quarantine or rejection for messages that fail the policy.
Once you have verified legitimate senders and fixed authentication problems, you can consider a stronger policy such as:
v=DMARC1; p=quarantine; rua=mailto:[email protected]or:
v=DMARC1; p=reject; rua=mailto:[email protected]Do not move directly to p=reject if you have not identified every legitimate system sending email for your domain.
A legitimate marketing platform, application, CRM, WordPress website, support system, or transactional email provider can be affected by an incorrectly configured DMARC policy.
How Does DMARC Alignment Affect Email Delivery?
DMARC does not simply ask whether SPF or DKIM passed.
It also checks alignment.
For example, a message could pass SPF for:
mailer.example-email-provider.comwhile the visible From address is:
[email protected]The SPF authentication may pass, but DMARC also evaluates whether the authenticated domain aligns with the domain shown in the From header.
The same concept applies to DKIM’s d= domain.
DMARC can pass when at least one authenticated identifier aligns with the visible From domain under the applicable alignment rules.
This is one reason an email can show:
SPF: PASS
DKIM: PASS
DMARC: FAILThe underlying authentication passed, but the identifiers did not align correctly.
What SPF, DKIM, and DMARC Records Should You Have?
A typical domain using its own mail infrastructure may have records resembling:
| Record | Type | Example |
|---|---|---|
| SPF | TXT | v=spf1 ip4:203.0.113.10 ~all |
| DKIM | TXT | selector._domainkey + generated public key |
| DMARC | TXT | v=DMARC1; p=none; rua=mailto:[email protected] |
| MX | MX | Your mail server hostname |
The exact values must match your actual mail server and email providers.
For CyberMail, current CyberPanel documentation provides provider-specific SPF, DKIM, DMARC, and MX values.
How Do You Check if SPF Is Working?
After publishing the record, query your domain:
dig TXT example.comLook for the SPF record beginning with:
v=spf1You can also query a specific DNS resolver:
dig @1.1.1.1 TXT example.comor:
dig @8.8.8.8 TXT example.comIf you have multiple SPF records, fix that before continuing.
Also confirm that every legitimate sending service is included.
For example, if your website sends through one server and your newsletter platform sends through another, both systems must be authorized appropriately.
How Do You Check if DKIM Is Working?
You need the selector used by your mail server.
A DKIM DNS lookup typically looks like:
dig TXT selector._domainkey.example.comReplace selector with the actual selector.
If the record exists, you should see the public key.
However, DNS presence alone does not prove that outgoing messages are being signed correctly.
Send a real test email and inspect the message headers.
Look for something similar to:
DKIM-Signature:Then check the receiving provider’s authentication results.
How Do You Check if DMARC Is Working?
Query the DMARC record:
dig TXT _dmarc.example.comYou should see something beginning with:
v=DMARC1For example:
v=DMARC1; p=none; rua=mailto:[email protected]Then send a test message to an external mailbox and inspect its authentication results.
The goal is to confirm:
SPF: PASS
DKIM: PASS
DMARC: PASSMore importantly, check that the authentication results are associated with the correct domain.
How Do You Use Email Headers to Troubleshoot Delivery?
Email headers can tell you much more than the visible message.
Look for:
Authentication-Results:You may see results such as:
spf=pass
dkim=pass
dmarc=passor:
spf=fail
dkim=pass
dmarc=failYou should also inspect:
Return-PathFromDKIM-SignatureReceivedMessage-ID- Sending hostname
- Authentication results
If an email reaches Gmail or another major provider, its authentication results can help identify whether the problem is DNS authentication or something else.
Why Does Email Go to Spam Even When SPF, DKIM, and DMARC Pass?
Authentication does not guarantee inbox placement.
You can have:
SPF: PASS
DKIM: PASS
DMARC: PASSand still land in spam.
Other factors can include:
- Poor IP reputation
- Poor domain reputation
- High spam complaints
- Suspicious sending patterns
- Sudden volume increases
- Poor list quality
- Malware or compromised accounts
- Misleading subject lines
- Poor message formatting
- Invalid recipient addresses
- Previous abuse from the sending IP
Google’s Gmail sender guidelines require senders to meet specific authentication, DNS, TLS, and spam-rate requirements, while also providing recommendations for improving email delivery.
Authentication is therefore necessary for reliable delivery, but it is not the entire deliverability system.
How Does Reverse DNS Help Fix Mail Delivery?
Reverse DNS, also called a PTR record, maps your sending IP address back to a hostname.
For example:
203.0.113.10 → mail.example.comThe hostname should then resolve back to the same IP through forward DNS.
Google’s current sender requirements specifically state that the public sending IP should have a PTR record and that the hostname should resolve back to the same IP address through an A or AAAA record.
You can check reverse DNS with:
dig -x 203.0.113.10Then verify the hostname:
dig A mail.example.comThe results should correspond to your actual mail server.
If your VPS provider controls PTR records, you may need to configure reverse DNS through the provider’s dashboard rather than your domain DNS manager.
Does Your Mail Server Hostname Affect Delivery?
Yes.
Your mail server should use a valid hostname.
For example:
mail.example.comThe hostname should have a corresponding DNS record, and your server’s reverse DNS should normally point back to that hostname.
A mismatch such as:
Server hostname: server123.provider.com
PTR: mail.example.com
A record: no matching IPcan create delivery problems.
Keep the hostname, forward DNS, reverse DNS, and SMTP identity consistent.
How Do You Configure SMTP Securely?
When applications send mail through SMTP, use authenticated submission with TLS where supported.
For current CyberMail SMTP delivery, CyberPanel documents:
| Setting | Value |
|---|---|
| Host | mail.cyberpersons.com |
| Port | 587 |
| Security | STARTTLS |
| Authentication | AUTH PLAIN or AUTH LOGIN |
CyberPanel recommends port 587 for new SMTP integrations and notes that port 25 can be blocked by some ISPs and cloud providers.
For a self-hosted mail server, use the SMTP hostname and credentials configured for that server rather than copying CyberMail settings.
Why Is Port 25 Important for Mail Delivery?
Port 25 is primarily used for server-to-server SMTP delivery.
Port 587 is commonly used for authenticated message submission from applications and email clients.
Do not assume that opening port 25 guarantees successful delivery.
Your VPS provider may restrict outbound SMTP traffic, and receiving mail providers can still reject or defer your messages based on authentication, reputation, DNS, or policy.
If your application only needs authenticated SMTP submission, port 587 is generally the better choice.
How Do You Fix an SPF Fail Error?
If your email shows:
SPF: FAILCheck these issues:
1. Is the sending IP authorized?
Make sure the actual sending server is included in SPF.
2. Are there multiple SPF records?
Merge them into one record.
3. Did you add every email provider?
Include legitimate third-party services.
4. Did you exceed the SPF lookup limit?
Reduce unnecessary DNS-based mechanisms and includes.
5. Are you checking the correct domain?
SPF applies to the domain used for the SMTP envelope identity, which may differ from the visible From address.
The SPF standard limits DNS-query-causing mechanisms to 10 during evaluation.
How Do You Fix a DKIM Fail Error?
If DKIM fails:
- Confirm that the selector is correct.
- Check the selector’s DNS record.
- Make sure the public key matches the private key used by the mail server.
- Confirm that the mail server is actually signing outgoing messages.
- Check whether the message was modified during transit.
- Check for incorrect line wrapping or DNS formatting.
- Send a new test message after making changes.
If the DKIM DNS record does not match the key used by the sending server, verification will fail.
For CyberPanel, use the DKIM Manager to obtain the current key rather than manually creating a random record.
How Do You Fix a DMARC Fail Error?
If DMARC fails while SPF and DKIM appear to pass, check alignment.
For example:
From: [email protected]
SPF domain: mail.vendor.com
DKIM d=: vendor.comThe authentication may succeed but not align with the visible From domain under the DMARC policy.
Check:
- From domain
- Return-Path or MAIL FROM domain
- DKIM
d=domain - SPF result
- DKIM result
- DMARC alignment mode
DMARC requires an aligned authenticated identifier for the message to pass its authentication mechanism.
How Do You Fix an Email That Is Delayed?
A delayed message does not necessarily indicate a permanent failure.
Check the sending server’s mail queue:
mailqOn systems using Postfix, you can inspect queued messages with:
postqueue -pLook for the destination server’s response.
A temporary response such as:
4xxusually indicates that delivery has been deferred rather than permanently rejected.
A permanent:
5xxresponse requires investigation of the specific rejection reason.
Do not repeatedly resend the same message without understanding the queue response.
How Do You Check the Mail Queue in CyberPanel?
Current CyberPanel email management provides access to the Mail Queue from the Email area.
It also provides Email Debugger, which can help investigate sending and receiving problems. CyberPanel’s current documentation specifically recommends checking Email Debugger, Mail Queue, public DNS records, and mail ports when sending or receiving fails.
This is often faster than modifying DNS records blindly.
How Do You Fix Mail Delivery From WordPress?
If WordPress emails are not arriving, first determine whether WordPress is generating the message successfully.
Common examples include:
- Password reset emails
- Contact form notifications
- WooCommerce orders
- New user notifications
- Security alerts
If WordPress generates the message but the receiving provider never receives it, configure authenticated SMTP rather than relying on PHP’s default mail behavior.
Then verify:
- SMTP hostname
- SMTP port
- TLS/STARTTLS
- Username
- Password
- SPF
- DKIM
- DMARC
- From address
- Sending domain
If you use CyberMail, its current SMTP documentation provides authenticated SMTP settings for application integrations.
How Do You Prevent Email From Going to Spam?
To prevent email going to spam, focus on both authentication and sender reputation.
Use:
- SPF
- DKIM
- DMARC
- Valid forward DNS
- Valid reverse DNS
- TLS
- Consistent sending identity
- Clean recipient lists
- Appropriate sending volumes
- Accurate From addresses
- Clear unsubscribe mechanisms for applicable marketing messages
Google’s current sender guidance also recommends keeping spam rates below its stated threshold and using authentication correctly.
Do not assume that changing the subject line alone will solve a reputation problem.
How Does DMARC Reporting Help With Delivery?
DMARC reports can show which systems are sending mail using your domain.
A typical DMARC record can include:
rua=mailto:[email protected]Aggregate reports can help identify:
- Unknown sending servers
- Failed authentication
- Unauthorized senders
- Third-party platforms
- Alignment problems
- Legitimate services that need SPF or DKIM configuration
Start with monitoring before enforcing a strict DMARC policy if you do not yet understand all the legitimate senders using your domain.
What Is a Secure Mail Server Setup?
A secure mail server setup should include more than SPF, DKIM, and DMARC.
Use this baseline:
| Security area | Recommended practice |
|---|---|
| Authentication | SPF + DKIM + DMARC |
| SMTP submission | Authenticated TLS |
| Server hostname | Valid FQDN |
| Reverse DNS | PTR matches mail hostname |
| Forward DNS | Hostname resolves to sending IP |
| Mail accounts | Strong unique passwords |
| Server software | Keep updated |
| Open ports | Expose only required services |
| Abuse monitoring | Monitor logs and queues |
| Backups | Protect important mail data |
| Reputation | Monitor complaints and blocklists |
For a broader server hardening process, combine mail security with operating system and firewall hardening.
How Do You Verify the Complete Mail Setup?
After making changes, run through this checklist:
DNS
dig MX example.com
dig TXT example.com
dig TXT _dmarc.example.com
dig TXT selector._domainkey.example.comReverse DNS
dig -x YOUR_SERVER_IPListening services
sudo ss -tulpnSMTP connectivity
Test the configured SMTP service using the correct hostname and port.
Test email
Send a message to an external mailbox.
Headers
Inspect:
Authentication-Results
SPF
DKIM
DMARC
Return-Path
ReceivedServer logs
Review the mail server logs and queue for rejection or delivery errors.
Mail Delivery Troubleshooting Checklist
Use this checklist when an email is rejected, delayed, or sent to spam.
| Check | What to verify |
|---|---|
| MX | Correct receiving mail server |
| SPF | One valid SPF record |
| SPF authorization | Every legitimate sender included |
| SPF lookups | Within the allowed limit |
| DKIM | Correct selector and public key |
| DKIM signing | Outgoing messages are signed |
| DMARC | Record exists and policy is intentional |
| Alignment | SPF or DKIM aligns with From domain |
| Hostname | Valid mail server hostname |
| PTR | Reverse DNS points to mail hostname |
| Forward DNS | Mail hostname resolves correctly |
| TLS | SMTP connection uses TLS where required |
| SMTP | Correct host, port, credentials |
| Queue | No persistent delivery failures |
| Reputation | IP and domain are not suffering reputation problems |
| Headers | Authentication results pass |
| Content | Message is not triggering filtering |
| Sending volume | No unexplained spikes |
Frequently Asked Questions
Can SPF, DKIM, and DMARC guarantee inbox placement?
No. They authenticate email and help receiving systems evaluate its legitimacy, but inbox placement also depends on reputation, recipient behavior, sending practices, content, infrastructure, and provider-specific filtering.
Why does email work for Gmail but fail for another provider?
Different receiving providers use different filtering systems and reputation data. Check the exact SMTP rejection or delivery response from the affected provider instead of assuming that SPF, DKIM, or DMARC is the only cause.
Should you use p=reject immediately when setting up DMARC?
Not if you have not identified all legitimate senders. Start by monitoring authentication results, fix legitimate sending sources, and then consider moving toward a stronger policy.
Final Thoughts
To fix mail delivery, do not start by changing random DNS records.
First identify where the message fails.
Then verify the complete path:
Sending Server → DNS → SPF → DKIM → DMARC → SMTP → Reverse DNS → Reputation → Recipient Server
SPF tells receiving systems which senders are authorized.
DKIM proves that the message carries a valid cryptographic signature.
DMARC connects those authentication results to the domain shown in the visible From address and provides policy and reporting.
But reliable email delivery also requires a valid hostname, reverse DNS, TLS, correct SMTP configuration, good sending practices, and a healthy sender reputation.
If you manage email through CyberPanel, use its current Email tools, DKIM Manager, Email Debugger, and Mail Queue when troubleshooting instead of relying only on DNS checks.
Authenticate the sender, verify the server, inspect the headers, and troubleshoot the actual rejection.
