The error, explained. Then fixed.

SPF PermError: too many DNS lookups Your SPF record needs more than 10 DNS lookups to evaluate, so receivers stop and mark it broken. Here is why, what it costs you, and how to get back under the limit. dkim=fail (signature verification failed) The receiver found a DKIM signature on your message, fetched your public key, and the cryptographic check still did not match. Here is why it happens, what it costs you, and how to fix it. dmarc=fail dmarc=fail means the receiver could not authenticate your message under DMARC: neither SPF nor DKIM both passed and aligned with your From domain. Here is why it appears, what it costs you, and how to fix it. spf=softfail A receiver checked your SPF record, could not find the IP that sent the message, and your record ends in ~all — so it reports a soft fail. Here is why, what it costs you, and how to authorise the right sender. spf=fail (hardfail) The server that sent your message is not authorised by your domain's SPF record, and that record ends in -all, so the receiver reports a hard fail. Here is why, what it costs you, and how to fix it. spf=none A receiver looked for an SPF record on your sending domain and found none, so SPF neither passes nor fails — it simply does not apply. Here is why, what it costs you, and how to publish one. dkim=none The receiver looked for a DKIM signature and found none, so it had nothing to verify. Here is why the message went out unsigned, what it costs you, and how to get it signing. dmarc=none A receiver reports dmarc=none when it finds no enforcing DMARC policy for your From domain: either you publish no DMARC record, or the one you publish is set to p=none. Here is why it appears, what it costs you, and how to fix it. 554 5.7.1 — message rejected 554 5.7.1 is a permanent rejection. The receiving server refused your message on policy grounds — almost always failed authentication or a blocked sending IP. Here is why it happens, what it costs you, and how to clear it. 550 5.7.26 — unauthenticated email Gmail permanently rejected your message because it was not authenticated — neither SPF nor DKIM passed and aligned with your From domain. Here is why, what it costs you, and how to fix it. 550 5.7.1 — blocked The receiving server permanently refused your message on policy or reputation grounds. Here is what 550 5.7.1 blocked means, what it costs you, and how to get your mail accepted again. 421 4.7.0 — try again later A 421 4.7.0 reply is a temporary deferral, not a bounce. The receiver has closed the connection and asked you to retry — usually because of your sending rate or your reputation. Here is why, what it costs you, and how to clear it.