Web Hosting, Domains & Website Management
When business email stops, quotes, bookings and invoices go nowhere, and often nobody notices for a day. This guide finds the cause, from a full mailbox or wrong app settings to missing SPF, DKIM and DMARC records or a domain that quietly expired.
What you will learn
Applies to
Tools Required
Before you start
Important
Step-by-Step Guide
1 / 8 steps
Example bounce.
Step 1
Read the bounce message
Open the delivery failure and find the code. A 5xx code is a permanent rejection; a 4xx code is temporary and will be retried.
Expected result: You know whether the problem is the mailbox, the address, or a policy rejection.
Example bounce.
Open a command prompt and run nslookup -type=mx with your domain. The answer should name the server that hosts your mailboxes.
Expected result: MX points to your current mail host, not an old one.
> nslookup -type=mx example.comNon-authoritative answer:example.com MX preference = 0, mail exchanger = mail.example.com
Example domain.
Run nslookup -type=txt with your domain and find the line starting v=spf1. There must be exactly one, and it must list every service that sends for you.
Expected result: One SPF record that includes your host and any other senders.
> nslookup -type=txt example.comexample.com text = "v=spf1 +a +mx +ip4:192.0.2.10 include:spf.example.net ~all"
Example record.
Look up the DKIM record at the selector your provider uses: default._domainkey on cPanel servers. It should return a key starting v=DKIM1.
Expected result: A published DKIM key that matches the mail server.
> nslookup -type=txt default._domainkey.example.comdefault._domainkey.example.com text = "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
Selector varies by provider.
Look up _dmarc with your domain. Start with p=none and a reporting address; tighten it only when all your legitimate mail passes.
Expected result: A DMARC record exists and its policy matches your stage.
> nslookup -type=txt _dmarc.example.com_dmarc.example.com text = "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
In cPanel's Email section, open Email Deliverability. It shows the status of DKIM, SPF, DMARC and reverse DNS for each domain.
Expected result: Problems are flagged with a suggested record or a Repair button.
| Domain | Status | Action |
|---|---|---|
| example.com | Problems exist (SPF) | Repair |
| shop.example.com | Valid | Manage |
Repair works only if this server hosts your DNS.
In the Email section, open Email Routing. Use Local Mail Exchanger if cPanel hosts the mailboxes, and Remote Mail Exchanger if Google or Microsoft does.
Expected result: Mail from the website reaches the real mailboxes.
Example for mailboxes hosted with Google or Microsoft.
Open Email Accounts, choose Connect Devices for the mailbox, and copy the server name and ports into the mail app. Turn SMTP authentication on.
Expected result: The app sends and receives without certificate warnings.
Use the server name your host shows.
Interactive Demonstration
What is happening with your email?
Is your domain registration still active (not expired)?
If not, the likely cause
An expired domain stops DNS, so mail cannot be delivered.
What to do: Renew the domain with your registrar now and turn on auto-renewal.
Does nslookup -type=mx show your current mail host?
If not, the likely cause
MX records point to an old or wrong server.
What to do: Update the MX records at your DNS provider to the values your mail host gives.
Is the mailbox below its quota?
If not, the likely cause
A full mailbox rejects new mail.
What to do: Empty Trash and Spam, archive large attachments, or raise the quota in Email Accounts.
Does webmail show no new mail either?
If not, the likely cause
Mail is arriving on the server; the problem is your app or device.
What to do: Re-add the account in the app with the Connect Devices settings.
Every check passed
The sender's side or a filter may be blocking delivery.
What to do: Ask a sender for their bounce message and check your spam filter settings with your host.
Can you send from webmail?
If not, the likely cause
The server side is failing: account limit, suspension or blocklisting.
What to do: Read the bounce, then ask your host to check the mail queue, sending limits and blocklists.
Is the app using port 465 (SSL/TLS) or 587 (STARTTLS) with authentication on?
If not, the likely cause
Wrong port, no encryption or no SMTP authentication.
What to do: Set SMTP to 465 SSL/TLS or 587 STARTTLS, with your full address and password.
Is there exactly one SPF record that includes your mail server?
If not, the likely cause
Missing or duplicate SPF causes rejections.
What to do: Combine all senders into one SPF record, using the suggestion in Email Deliverability.
Every check passed
The recipient's server may reject your mail for its own policy.
What to do: Forward the full bounce to your host or IT provider for interpretation.
Does Email Deliverability show SPF and DKIM as valid?
If not, the likely cause
Receivers cannot verify that the mail is really from you.
What to do: Repair or install the suggested SPF and DKIM records, or add them at your DNS provider.
Do you have a DMARC record?
If not, the likely cause
Without DMARC, some receivers trust your mail less.
What to do: Add a DMARC record with p=none and a reporting address, then tighten later.
Are newsletters sent from a proper newsletter service, not a normal mailbox?
If not, the likely cause
Bulk mail from an ordinary mailbox damages reputation.
What to do: Move bulk mail to a newsletter service set up with your domain's records.
Every check passed
The shared server's IP may have a poor reputation.
What to do: Check the IP on a blocklist checker and ask your host about delisting or a different sending route.
Troubleshooting
Likely cause SPF, DKIM or DMARC is missing or does not cover the server that sent the message.
Solution Fix the records in Email Deliverability or at your DNS provider, keep one SPF record, and resend a test.
Likely cause Expired domain, MX pointing to an old host, or a full mailbox.
Solution Check the domain expiry, run nslookup -type=mx, and check the quota in Email Accounts.
Likely cause Weak or failing authentication, or poor sending reputation.
Solution Pass SPF and DKIM, add DMARC, use a newsletter service for bulk mail, and check blocklists.
Likely cause An old password saved on the device, or a lock after failed logins.
Solution Update the password on every device, or remove and re-add the account with manual IMAP settings.
Likely cause The app uses a server name that does not match the SSL certificate.
Solution Use the exact server name from Connect Devices in cPanel.
Likely cause Email Routing is set to local while mailboxes are with Google or Microsoft.
Solution Set Email Routing to Remote Mail Exchanger and send form mail through authenticated SMTP.
Likely cause The sending IP was listed, often after a compromised account sent spam.
Solution Secure the account first, then ask your host to request delisting for the shared IP.
In Depth
When business email stops, quotes, bookings and invoices go nowhere, and often nobody notices for a day. This guide finds the cause, from a full mailbox or wrong app settings to missing SPF, DKIM and DMARC records or a domain that quietly expired.
It applies to email on your own domain (such as name@yourcompany.co.tz), whether the mailboxes are on cPanel hosting with your website or with a provider such as Google Workspace or Microsoft 365. The checks in the tutorial are ordered so the quickest, most common causes come first.
| What you see | Where the problem usually is |
|---|---|
| A "delivery failed" message (a bounce) comes back | Read the code in the bounce: it usually names the cause |
| Nothing arrives from anyone | Expired domain, wrong MX records or a full mailbox |
| Mail arrives from some senders only | Spam filtering, or the sender's server is blocked |
| Your messages land in recipients' spam | SPF, DKIM or DMARC missing or failing; poor server reputation |
| Webmail works, but the phone or Outlook does not | App settings: server name, port, encryption or saved password |
| The app keeps asking for the password | Old password saved on a device, or a security lock after failed logins |
| Website contact forms never arrive, other mail is fine | Email Routing set wrongly in cPanel, or the form sends without authentication |
Bounces carry a three-digit code. A code starting with 5 is a permanent failure ("mailbox full", "user unknown", a rejection for SPF, DMARC or a blocklist). A code starting with 4 is temporary, and the sending server will retry for a while. Many bounces also include an enhanced code such as 5.7.1, where the first digit 5 means permanent and the middle digit 7 means a security or policy rejection. The IANA register of enhanced status codes lists the details: 5.7.1 is "delivery not authorized", 5.7.23 is an SPF failure and 5.7.26 means several authentication checks failed. Forward the whole bounce to whoever supports your email; the details below the headline matter.
| Record | What it does | What goes wrong |
|---|---|---|
| MX | Tells the world which server receives mail for your domain | After a move between hosts it still points to the old server |
SPF (a TXT record starting v=spf1) |
Lists the servers allowed to send for your domain | Missing, or two SPF records, which breaks both |
DKIM (a TXT record at selector._domainkey; cPanel uses default._domainkey) |
Publishes the public key that checks each message's signature | Missing, or the key on the server does not match DNS |
DMARC (a TXT record at _dmarc) |
Says what to do with mail that fails SPF and DKIM, and where to send reports | Missing, or set to reject before all senders pass |
| PTR (reverse DNS) | Maps the sending server's IP address back to a name | Missing or mismatched on the server's IP (the host or ISP controls it) |
Google's email sender guidelines require everyone sending to Gmail to use SPF or DKIM, valid forward and reverse DNS, and TLS. Senders of more than 5,000 messages a day to Gmail must also use SPF, DKIM and DMARC, align the From address with SPF or DKIM, and offer one-click unsubscribe on marketing mail.
Points that trip people up:
include, a, mx, ptr, exists and redirect; ip4, ip6 and all do not count). Above that, the SPF standard, RFC 7208, says the check returns an error (permerror), so a long chain of services can fail even when it looks right.p=none and a reporting address, read the reports, then move to quarantine or reject once all your legitimate mail passes.On cPanel hosting, the Email Deliverability page (Email section) checks DKIM, SPF, DMARC and reverse DNS for each domain, according to cPanel's documentation. Repair fixes invalid records automatically, but only when the server controls your DNS. If your DNS is hosted elsewhere (for example at your registrar or a CDN), copy the suggested records and add them there. For PTR, the owner of the server's IP address (your host) must make the change.
Plays from YouTube when you press play.
Warning Changing MX records moves where new email is delivered. Note the current records before editing, and change them only if you know where your mailboxes are hosted.
When a domain lapses its DNS stops, and so does email. Renew it straight away with your registrar; mail starts flowing once DNS is restored, which can take a few hours. Registries allow grace periods after expiry, but they are not unlimited and late recovery can cost more. Turn on auto-renewal and send renewal reminders to an address that is not on the same domain. See our domains page.
If your mailboxes are with Google or Microsoft but cPanel's Email Routing is set to Local Mail Exchanger, mail sent from your website or other accounts on the same server stays on the server and never reaches the real mailboxes. Set it to Remote Mail Exchanger in that case. If cPanel hosts the mailboxes, it should be local.
A mailbox over its quota rejects new mail. Empty Trash and Spam, archive large attachments, and if you use POP3, set the app to remove messages from the server after a few days, or switch to IMAP. Email Accounts in cPanel shows usage and lets you raise the quota if your plan allows.
| Purpose | Protocol | Port | Encryption |
|---|---|---|---|
| Receive (recommended) | IMAP | 993 | SSL/TLS |
| Receive (one device only) | POP3 | 995 | SSL/TLS |
| Send | SMTP | 465 | SSL/TLS |
| Send (alternative) | SMTP | 587 | STARTTLS |
If bounces mention a blocklist or "poor reputation", look up the sending server's IP address on a checker such as MXToolbox. First find and secure any compromised account (new strong passwords, malware checks on phones and computers). On shared hosting, the IP address is shared, so your host handles delisting.
Warning Thousands of messages you did not send in a Sent folder or the mail queue usually mean a compromised account. Change that mailbox password at once, from a clean device, and tell your host.
Fix SPF, DKIM and DMARC first. Send newsletters through a proper newsletter service set up with your domain's records, not from an ordinary mailbox. Avoid link shorteners and unexpected attachments, and ask regular contacts to mark your messages as "not spam".
Contact your host or IT provider if your DNS is managed somewhere you cannot reach, you are moving between email providers, you suspect a hacked account, your server is blocklisted, or bounces mention errors you cannot interpret. Have ready:
Extrion Tech hosts business email on cPanel, alongside shared hosting, VPS servers and dedicated WordPress hosting, registers domains and can set up MX, SPF, DKIM and DMARC records correctly. See our hosting plans or contact us with your domain name and a copy of the bounce message.
This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.
FAQs
Most often SPF or DKIM is missing or failing, or the From domain does not align with them for DMARC. Check the Email Deliverability page in cPanel, or your provider's admin console, and fix what is flagged. A shared server with a poor reputation can also be the cause.
IMAP, if you read email on more than one device. It keeps everything in sync on the server. POP3 downloads to one device and only suits a single computer with its own backups.
Either works with most hosts. Port 465 uses SSL/TLS from the start; 587 starts plain and upgrades with STARTTLS. Use whichever your host's Connect Devices page shows, and never port 25 from an app.
No. Two SPF records make SPF fail completely. Combine every service that sends for you into one record, and keep it within the limit of 10 DNS lookups.
Messages sent while the domain was expired probably bounced back to their senders. Mail already in your mailbox is usually still on the server. Renew quickly and check with your host.
For bulk senders to Gmail (more than 5,000 a day), yes. For everyone else it is strongly recommended, because it protects your domain from being forged and gives you reports on who sends as you. Start with p=none.
Bounces often name the blocklist. You can also check the sending IP address on a blocklist checker such as MXToolbox, and ask your host if the IP is shared.
Reliable hosting and business email with local support, backups and help when something goes wrong.
Ask for clarification, tell us a problem this did not solve, or suggest a topic. An engineer reads every message, and we use them to improve the Knowledge Center.
Keep learning
Web Hosting, Domains & Website Management
30 min
Troubleshooting fix
A "508 Resource Limit Is Reached" page means your hosting account hit one of the limits CloudLinux sets for it, usually the number of requests that ca...
View Guide
Web Hosting, Domains & Website Management
8 min
Comparison
Business software, shared files and email can run on a server in your own building or in the cloud, on a provider's servers reached over the internet....
View Guide
Web Hosting, Domains & Website Management
10 min
Comparison
Shared hosting, a VPS and cloud hosting differ in how much of a server is yours, how much power you can count on and who looks after it. Most small bu...
View Guide
Web Hosting, Domains & Website Management
12 min
A website's cost depends on its size, functions, content and upkeep, so a five-page company profile, a shop taking mobile money and a staff portal are...
View GuideEngineers reply Mon – Fri, 08:00 – 17:00
We'll send a copy of the conversation to our team. Next time, the chat starts fresh.
