Mail from a domain lands in spam
When to use: recipients report messages in Junk/Spam, or a receiver bounces with a policy message (550-5.7.26 … DMARC, 550 5.7.1 … SPF).
Preconditions: admin access; access to the domain’s DNS.
- Domains →
→ DNS & routing → Verify now. Fix every row that is notverified, in this priority: A (mail host), MX, SPF, DKIM, then DMARC and the SRV records.mismatchshows what is actually published — usually an old SPF record, or a DKIM key truncated or mangled on paste (whitespace insidep=is ignored, so line breaks alone do not cause a mismatch). - Dashboard → Server reputation: every blocklist
ok(otherwise The server IP is on a blocklist); rDNS / HELOok— if not, set the PTR for the IP to the mail hostname at your VPS provider and make sure the hostname’s A record points at the IP; TLS certificate valid. That last one comes from the worker’s hourly reputation job and is reported on the dashboard —mailctl doctorchecks only the certificate the web front ends present on HTTPS, not the one on the mail ports, so it cannot confirm this row. - Send a message from a mailbox in the domain to a fresh https://www.mail-tester.com/ address and read the report: it names the exact failing check (SPF, DKIM, DMARC, rDNS, blocklists, HTML/text ratio). Aim for 10/10 — anything the report blames on DNS goes back to step 1.
- If SPF/DKIM/DMARC all pass and mail still lands in spam: the IP is new or “cold”. Send low volumes to engaged recipients for the first weeks (the server has a built-in warm-up schedule — see Outbound rate limits), avoid bulk sends, and check Google Postmaster Tools / Microsoft SNDS for domain reputation.
- DMARC: once reports look clean, tighten the published policy from
p=nonetop=quarantine, laterp=reject— the verifier accepts any policy.
Verification
Section titled “Verification”mail-tester.com reports 10/10; a message to Gmail shows spf=pass dkim=pass dmarc=pass under Show original; no open alerts on the dashboard.
Rollback
Section titled “Rollback”DNS changes only; revert a record at the DNS provider if a change made things worse (the previous value is in the alert/observed list of the verification result).