====== Email Deliverability Troubleshooting Guide ======

**Email Deliverability** is the ability to successfully deliver emails to a recipient's primary inbox without being delayed, bounced, or flagged as spam. 

Achieving high deliverability requires a combination of proper email authentication, strict server security, clean domain reputation, and compliant content practices. This guide covers the essential steps to diagnose and fix email deliverability issues.

----

===== The Pillars of Email Deliverability =====

Inbox providers (such as Gmail, Microsoft 365, Yahoo, and Apple Mail) evaluate three main layers before placing an email in the primary inbox:

  # **Authentication Protocols:** Verifying that the sender actually owns the domain and that the message was not altered in transit.
  # **Infrastructure & IP Health:** Ensuring the sending mail server has proper reverse DNS, SSL/TLS security, and is clean of blocklists.
  # **Domain & Sender Reputation:** Historical engagement data (open rates, spam complaints, bounce rates).

----

===== Key Checklist for Inbox Placement =====

^ Category ^ Requirement ^ Status / Reference ^
| **Authentication** | Valid [[email:dns-configuration:spf|SPF Record]] published | Essential |
| **Authentication** | Cryptographic [[email:dns-configuration:dkim|DKIM Signatures]] enabled | Essential |
| **Authentication** | Enforced [[email:dns-configuration:dmarc|DMARC Policy]] (`p=quarantine` or `p=reject`) | Essential |
| **Infrastructure** | [[email:troubleshooting:reverse-dns|Forward-Confirmed Reverse DNS (FCrDNS)]] | Essential |
| **Infrastructure** | [[email:dns-configuration:mx-records|MX Records]] pointing to valid FQDNs | Essential |
| **Encryption** | [[email:dns-configuration:mta-sts|MTA-STS]] & [[email:dns-configuration:tls-rpt|TLS-RPT]] configured | Recommended |
| **Branding** | [[email:dns-configuration:bimi|BIMI Record]] & VMC logo verification | Optional |

----

===== Step-by-Step Deliverability Troubleshooting =====

==== Step 1: Diagnose Bounce Codes ====
When deliverability drops, inspect non-delivery reports (NDRs) or server logs for 4xx and 5xx errors:
  * **550 5.7.1 Access Denied / Rejected:** Usually indicates an IP blacklist hit or failed SPF/DKIM/DMARC alignment.
  * **550 5.1.1 Unknown User:** Indicates high hard bounce rates due to stale or invalid subscriber lists.
  * *For a detailed guide on error codes, read [[email:troubleshooting:bounces|SMTP Status Codes & Email Bounces]].*

==== Step 2: Verify Authentication & Alignment ====
Ensure your domain passes all three core protocols:
  * **SPF Alignment:** Make sure your `MAIL FROM` envelope domain matches your `From:` header domain.
  * **DKIM Alignment:** Verify that your outbound mail client or MTA signs outgoing emails with a valid DKIM selector.
  * **DMARC Compliance:** Ensure at least one protocol (SPF or DKIM) passes **and** aligns with the `From:` header.

==== Step 3: Inspect Email Headers ====
If messages land in the Spam folder instead of bouncing:
  * Extract the raw [[email:troubleshooting:mail-headers|Email Headers]] from a test message sent to Gmail or Outlook.
  * Look at the `Authentication-Results:` line to see if `spf`, `dkim`, or `dmarc` show `fail` or `softfail`.
  * Check spam score tags (e.g., `X-Spam-Status` or `SCL` headers).

==== Step 4: Check IP & Domain Blacklists ====
If your sending IP or domain is listed on major Real-time Blackhole Lists (RBLs) like Spamhaus, Barracuda, or Spamcop:
  * Identify and stop the root cause (e.g., compromised user accounts sending spam, open relays, or high spam complaints).
  * Request a delisting on the specific RBL provider's portal after fixing the issue.

==== Step 5: Clean Your Mailing Lists ====
  * **Remove Hard Bounces Immediately:** Continuously sending mail to non-existent addresses severely damages domain reputation.
  * **Implement Double Opt-In:** Require new users to confirm their email address before sending marketing or operational updates.
  * **Unsubscribe Mechanisms:** Always include a single-click unsubscribe link and a `List-Unsubscribe` header.

----

===== Diagnostics with Telenegar Tools =====

You can audit and optimize your email deliverability setup using **Telenegar Tools**:

==== Using Telenegar Tools ====
  * **Full Authentication & Mail Scan:** Test your SPF, DKIM, DMARC, MX, and SMTP responses using the [[tools:mailcheck|Telenegar Mail Check Tool]].
  * **DNS Propagation Check:** Validate that your authentication TXT records are fully propagated globally via the [[tools:dnscheck|Telenegar DNS Check Tool]].

----

===== Related Documentation =====

  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication and mail server health.
  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS record resolution and propagation.
  * [[email:dns-configuration:spf|SPF]] | [[email:dns-configuration:dkim|DKIM]] | [[email:dns-configuration:dmarc|DMARC]] — The core authentication stack.
  * [[email:troubleshooting:bounces|SMTP Status Codes & Email Bounces]] — Common non-delivery codes explained.
  * [[email:troubleshooting:mail-headers|Email Headers]] — Learn how to parse raw message headers for spam indicators.
  * [[email:troubleshooting:reverse-dns|Reverse DNS (PTR)]] — Set up FCrDNS for outbound mail servers.