Troubleshooting
Start from what you are seeing. Almost every email problem is one of three things: a DNS record that is not there, a client pointed at the wrong port, or a sending limit doing exactly what it is supposed to.
Find your symptom
| What you see | Where to go |
|---|---|
| Mail sent to your domain never arrives | Nothing arrives |
A record reads Missing after you added it | DNS still says Missing |
| Auto-configure fails, or there is no button | Auto-configure does nothing |
| The client cannot connect, or keeps asking for the password | The client will not log in |
| Sending fails and the client keeps retrying | Sending is being throttled |
451 4.4.5 Rate limit exceeded, try again later. | Sending is being throttled |
| Recipients treat your mail as spam | Your mail is marked as spam |
| Incoming mail lands in Junk | Incoming mail lands in Junk |
Email could not be saved when creating an address | An address will not save |
Nothing arrives
Mail sent to an address on the domain never shows up, and the sender either gets a bounce or nothing at all.
Check the MX record first, from outside the portal:
dig +short MX example.comThe correct answer is:
10 mail.itsh.dev.Then work down, in this order:
No MX record at all, or someone else's. The domain still points at whatever handled its mail before. Add the record from Setting up a domain, or press Auto-configure if your DNS is hosted here.
The MX is right but the address does not exist. An alias or mailbox has to exist for each address you expect mail on. There is no implicit delivery to a domain, only to addresses on it, unless you have set a catch-all.
The address exists but is inactive. Creating an address with Active switched off means it is refused on delivery. The Mailboxes tab shows the state per row.
It was refused as spam or as infected. In that case the sender has a bounce message saying so. Nothing was delivered and nothing is being held; see Limits.
DNS still says Missing
You added a record, the DNS & Setup tab still marks it Missing.
It is genuinely not published yet. Records are checked by resolving them live, so what matters is what the world sees, not what your provider's panel shows. Confirm from outside:
dig +short TXT _dmarc.example.comThe old value is still cached. If a record existed before with a different value, resolvers keep serving the old one until its TTL runs out. Give it an hour before assuming anything is wrong.
The value does not match exactly. TXT records are compared for an exact match. A DKIM key that lost a character on the way through a copy and paste, extra quoting added by your DNS provider, or a line break in the middle of the key are the usual culprits. Copy it again from the DNS & Setup tab.
Auto-configure does nothing
The domain's DNS is not hosted here. The button only writes into zones we serve. Pressed for a domain on external nameservers it fails without explaining why, and no records are created. Nothing is wrong with the domain: add the records at your own provider by hand.
The button is not shown at all. For a domain you bought only for email it is hidden even when the zone is hosted here. Use the record table in Setting up a domain.
The client will not log in
Check the port before anything else. Outgoing mail is 587 with STARTTLS. A client set to 465 has nothing to talk to and will sit there until it times out. Incoming is 993 with SSL/TLS, or 143 with STARTTLS.
The username must be the whole address. you@example.com, not you. This is the single most common cause of a password prompt that never goes away.
The outgoing server needs authentication too, with the same credentials as the incoming one. Clients that leave it off get connected and then refused when they try to send.
Confirm whether the password is really wrong on the mailbox's Login History page. A failed attempt is recorded there with its IP address and protocol. If the attempts are not showing up at all, the client is not reaching the server and this is a port or hostname problem, not a password one.
Sending is being throttled
Mail sits in the outbox, the client reports a temporary failure and tries again later.
Your account is less than 30 days old. Each mailbox is limited to 30 messages an hour and 100 a day for the first 30 days. The Email page shows the days remaining and offers Request an early lift if you are migrating mailboxes.
Nothing is lost. A throttled message is refused temporarily, stays in the client, and most clients retry on their own.
451 4.4.5 Rate limit exceeded, try again later.
The steady-state limit rather than the new-account one: 200 messages an hour and 2,000 a day per mailbox. Spread the send out, or split it across the mailboxes that legitimately own those addresses.
If this is a mailing to a list of recipients, it is the wrong tool. Mass mailings are not permitted on the service.
Your mail is marked as spam
Recipients find your messages in their spam folder, or their server rejects them.
Confirm all three authentication records are published. SPF, DKIM and DMARC are what a receiving server checks, and the DNS & Setup tab has to read configured, not partial.
dig +short TXT example.com
dig +short TXT mail._domainkey.example.comYou are also sending from somewhere else. The SPF record ends in -all, meaning anything not listed in it fails. A shop, a CRM or a newsletter tool sending as your domain has to appear in the same SPF record. If your DNS is hosted here, add their include: to the existing record rather than replacing it; the nightly job merges rather than overwrites, so both survive.
The domain is new. Receiving servers distrust domains they have never seen before, whatever the records say. Volume built up slowly over a couple of weeks does more for this than any configuration change.
Incoming mail lands in Junk
The message was accepted and delivered, just into the Junk folder rather than the Inbox.
Filter sensitivity is fixed and there is no setting to relax it. What you can do is override it per mailbox: create a filter on the mailbox that matches the sender and files it into the Inbox. See Mailboxes and aliases.
Junk is an ordinary IMAP folder. If it is not visible in your client, subscribe to it in the client's folder list.
An address will not save
The portal reports Email could not be saved. The likely causes, in order:
The address already exists. Addresses are unique across the whole platform, so a mailbox, alias or list anywhere with that name blocks it.
The local part has an unsupported character. Letters, digits, dots and hyphens only.
The password is too weak or too short. Minimum 8 characters, and the form rejects passwords it judges weak beyond that.
An alias points back at itself. A forwarding loop, directly or through another alias, is refused.
The domain is at its ceiling, which is 1,000 mailboxes or 5,000 aliases. See Limits.
What's next
- Setting up a domain for the full DNS record set
- Limits for the numbers behind the rejections above