Email Server Troubleshooting: Complete Diagnostic Guide

Common Symptoms

Symptom	Likely Cause	Start Here
Emails bouncing	Bad MX, SPF fail, blacklisted IP	DNS Checks → Blacklist Check
Emails going to spam	Missing DKIM/DMARC, low reputation	Authentication Issues
Cannot connect to SMTP	Port blocked, TLS mismatch	SMTP Diagnostics
Delayed delivery	Greylisting, queue backup, DNS timeout	Queue Management
Connection refused	Firewall, service down, wrong port	SMTP Diagnostics

DNS Configuration Checks

Most email problems start with DNS. Verify these records first:

MX Records

dig MX example.com +short

Verify priorities are correct and hostnames resolve to valid IPs. Missing MX records = no email delivery.

Reverse DNS (PTR)

dig -x 203.0.113.10 +short

Your mail server IP must have a PTR record matching its hostname. Many receivers reject mail from IPs without valid rDNS.

SPF Record

dig TXT example.com +short | grep spf

Ensure your sending IPs are included. Check for the 10-lookup limit with the DNS Lookup Tool.

SMTP Diagnostics

Test SMTP connectivity directly:

Test with OpenSSL

openssl s_client -connect mail.example.com:465
# or for STARTTLS:
openssl s_client -starttls smtp -connect mail.example.com:587

Common SMTP Error Codes

Code	Meaning
421	Service temporarily unavailable (try again later)
450	Mailbox unavailable / greylisted
550	Permanent rejection (user not found, policy block)
553	Invalid sender address
554	Transaction failed (often blacklist or DMARC rejection)

Use the SMTP Tools for automated connectivity testing.

Authentication Issues

SPF Failures

Check: Is the sending IP included? Are there too many DNS lookups (max 10)? Is the mechanism order correct? Use ~all for testing, -all for production.

DKIM Failures

Verify the DKIM selector DNS record exists: dig TXT selector._domainkey.example.com. Check key length (2048-bit recommended), correct body/header canonicalization, and that the signature hasn't been broken by intermediary servers.

DMARC Failures

DMARC requires either SPF or DKIM to pass AND align with the From domain. Check alignment mode (strict vs relaxed) and review aggregate reports for failure patterns.

Blacklist & Reputation

If your mail server IP is on a blacklist, many recipients will reject your email outright.

Check your IP with the RBL Blacklist Checker
Common blacklists: Spamhaus (SBL/XBL/PBL), Barracuda, SORBS, SpamCop
To delist: fix the root cause first, then submit a delisting request to each RBL
Build sender reputation gradually with email warm-up

TLS & Certificate Problems

Certificate Mismatch

The certificate CN/SAN must match the hostname used in the MX record. If MX points to mail.example.com, the cert must cover that exact hostname.

Expired Certificate

Strict senders using MTA-STS or DANE will refuse to deliver to servers with expired certificates. Set up auto-renewal monitoring.

STARTTLS Not Working

Some firewalls strip the STARTTLS command from SMTP sessions (STARTTLS stripping attack). Use port 465 (implicit TLS) as an alternative.

Mail Queue Management

Postfix

mailq                    # View queue
postsuper -d ALL         # Delete all queued mail
postsuper -r ALL         # Requeue all mail
postqueue -f             # Flush the queue

Exim

exim -bpc              # Count queued messages
exim -bp               # List queue
exim -qff              # Force delivery attempt

Diagnostic Commands Cheat Sheet

Task	Command
Check MX records	`dig MX example.com`
Test SMTP connection	`telnet mail.example.com 25`
Check SPF record	`dig TXT example.com`
Check DKIM record	`dig TXT sel._domainkey.example.com`
Check DMARC	`dig TXT _dmarc.example.com`
Check reverse DNS	`dig -x IP_ADDRESS`
Test TLS certificate	`openssl s_client -connect host:465`
View mail logs	`tail -f /var/log/mail.log`

FAQ

Why are my emails bouncing?

Emails bounce for many reasons: invalid recipient (550 5.1.1), full mailbox (552), blacklisted IP (554), missing MX records, or SPF/DKIM/DMARC failures. Check the bounce DSN code for the specific reason.

How do I check if my IP is blacklisted?

Use the RBL Blacklist Checker to scan your IP across 50+ blacklists.

What does SMTP error 550 mean?

SMTP 550 is a permanent rejection. Common sub-codes: 5.1.1 (recipient not found), 5.7.1 (policy/SPF rejection), 5.7.23 (DMARC failure).