Email delivery failed: the message that never bounced

A receiver can accept your message and then file it in spam or quarantine without a word to you. That silent failure shows up in your DMARC aggregate reports rather than your inbox, and this page is about reading them. A bounce with a code in it has its own page.

Was the message delivered? If you got no bounce, it was accepted. Accepted and delivered to the inbox aren't the same thing.

If you have a bounce, read the code

A bounce means the receiver refused, and it always quotes the reason. Gmail's notice has it after The response from the remote server was. Microsoft's notice, headed Delivery has failed to these recipients or groups, has it under Diagnostic information for administrators on a line starting Remote Server returned. Postfix has it on the said: line.

The code decides the fix. A 5.1.1 is a wrong address. A 5.7.26 or a 5.7.1 naming DMARC is your domain's authentication. Hard bounce vs soft bounce has the full table, sorted by who owns the fix. The rest of this page is for the case where there's no code because there's no bounce.

No bounce: the receiver accepted, then held it

The SMTP conversation ends when the receiving server says 250 OK. Your server logs the message as delivered and forgets it. What the receiver does after that is its own business, and at Gmail, Microsoft and Yahoo the usual answer to a message that fails authentication is to accept it and route it away from the inbox.

They do that on purpose. A refusal at SMTP time tells the sender exactly what tripped the filter. Spammers use that. So the filter stays quiet, and legitimate senders with a broken SPF record get the same silence as the spammers.

Three places the message can be:

• The spam or junk folder. Gmail's default for a message that fails DMARC under p=quarantine, and for most reputation problems.
• Quarantine. Microsoft 365's default for a DMARC failure and for high-confidence spam. The recipient can't see it. Their admin can, in the Defender portal. Email quarantined covers the release.
• Dropped. Rare, and mostly for malware verdicts. The message is gone and nobody is told.

Check the DMARC report, not the bounce

Every big receiver sends a daily report to the address in your domain's DMARC record. It lists each server that sent mail as your domain that day, whether SPF and DKIM passed for it, and what the receiver did with the mail. That last field is the one you need. It's called disposition.

If your DMARC record has no rua= tag, nobody is receiving those reports and you're flying blind. Add one:

Reports start the next day. Each one is an XML file, and the row for a failing sender looks like this:

Read it bottom up. SPF passed, but for mailer.example.org, the sending service's own domain. The From header says example.com. Those don't match, so as far as DMARC is concerned SPF failed. DKIM failed outright, probably because the service isn't signing with your domain. The receiver applied your p=quarantine to 41 messages from that IP. None of them bounced. All of them went to spam.

Reading a report by hand walks through every field. The source IP is the server to fix, and the fix is usually turning on DKIM signing with your domain for it.

Fix the sender the report points at

1. Find the IP in the report row, and work out which service it belongs to. A reverse lookup usually says:
   dig +short -x 203.0.113.24
2. In that service's settings, find its domain authentication and turn on DKIM for your domain. It gives you a CNAME or TXT record to publish. Publish it.
3. Add the service to your SPF record if it isn't there, and check the whole record with the SPF checker to stay under the lookup limit.
4. Send one message from that service to an address you control at the receiver in question. Open the headers. Authentication-Results should show dmarc=pass.
5. Read the next day's report. The same IP should now show dkim pass and a disposition of none.

Ask the recipient for the headers

For one message to one person, the recipient's copy has the answer. Ask them to find it in spam and send you the headers, or a screenshot of the line that starts Authentication-Results. It says which check failed and for which domain. At Microsoft 365 the equivalent is X-Forefront-Antispam-Report, and the verdict in it is what the quarantine page explains.

The failures you're not looking for

The message you noticed is one of many. Every other message from the same service to the same receiver went the same way, and services you've forgotten about are failing too. Our weekly digest reads every aggregate report that arrives and lists each sender that failed and what receivers did with its mail. On a paid plan we email you the day an unfamiliar sender first fails, which is how you hear about a marketing tool that was wired up without a word to you. Your first domain is free.