Troubleshooting

Start from what you are seeing. Almost every email problem is one of three things: a DNS record that is not there, a client pointed at the wrong port, or a sending limit doing exactly what it is supposed to.

Find your symptom

What you see	Where to go
Mail sent to your domain never arrives	Nothing arrives
A record reads Missing or Not right after you added it	DNS still says Missing
Auto-configure fails, or there is no button	Auto-configure does nothing
The client cannot connect, or keeps asking for the password	The client will not log in
Sending fails and the client keeps retrying	Sending is being throttled
452 4.4.5 Rate limit exceeded, try again later.	Sending is being throttled
452 4.7.1 Rate limit exceeded	Sending is being throttled
Recipients treat your mail as spam	Your mail is marked as spam
Incoming mail lands in Junk	Incoming mail lands in Junk
Email could not be saved when creating an address	An address will not save

Nothing arrives

Mail sent to an address on the domain never shows up, and the sender either gets a bounce or nothing at all.

Check the MX record first, from outside the portal:

dig +short MX example.com

The correct answer is:

10 mail.itsh.dev.

Then work down, in this order:

No MX record at all, or someone else's. The domain still points at whatever handled its mail before. Delete the old provider's MX records and add ours from Setting up a domain; with the old ones left in place, part of your mail keeps going there. If your DNS is hosted here, Auto-configure adds ours once the old ones are gone.

The MX is right but the address does not exist. An alias or mailbox has to exist for each address you expect mail on. There is no implicit delivery to a domain, only to addresses on it, unless you have set a catch-all.

The address exists but is inactive. Mail to an inactive mailbox is accepted and then bounced back to the sender. An inactive alias or mailing list forwards nothing to its targets. Mail to it is refused, or can end up in the domain's catch-all if one is set, and in a message that also goes to other recipients its copy can be dropped without a bounce. The Mailboxes tab shows the state per row.

It was refused as spam or as infected. In that case the sender has a bounce message saying so. Nothing was delivered and nothing is being held; see Limits.

DNS still says Missing

You added a record, the DNS & Setup tab still marks it Missing or Not right.

It is genuinely not published yet. If your DNS is hosted here, the tab reads the zone directly and shows a change at once. Anywhere else, records are checked by resolving them live, so what matters is what the world sees, not what your provider's panel shows. Confirm from outside:

dig +short TXT _dmarc.example.com

The old value is still cached. If your DNS is hosted elsewhere and a record existed before with a different value, resolvers keep serving the old one until its TTL runs out. Give it an hour before assuming anything is wrong.

It reads Not right. Something is published under that name, just not what mail needs, and the card shows what it found. Compare that with the expected value. The usual culprits:

• a DKIM key that lost a character in a copy and paste, or that your provider stored with extra quotes;
• a second SPF or DMARC record next to the first, which makes receivers ignore both: merge them into one;
• the old provider's MX left next to ours: delete it;
• a CNAME on the name, which hides every other record there.

An SPF record counts when our ip4: is part of it ahead of its all, a DMARC record when our address is in its rua. Copy values from the DNS & Setup tab, where every field has its own copy button.

Auto-configure does nothing

The button is not shown at all. It is offered only when the domain's DNS is hosted here, your account may change it, and something is left that it can fix. For a domain on external nameservers, add the records at your own provider by hand. For a domain you bought only for email it is hidden even when the zone is hosted here; use the record cards on the DNS & Setup tab.

A record still reads Not right afterwards. Auto-configure never adds a record next to one that conflicts with it: another provider's MX, a second DKIM key, a CNAME on the name, or more than one SPF or DMARC record. Remove the conflicting record, then press it again.

It reports an error. Some records could not be written. The tab shows which ones are in place; try again later. If setup is already running for the domain, or too many requests came in a short time, the message says so; wait a minute then.

The client will not log in

Check the port before anything else. Outgoing mail is 587 with STARTTLS. A client set to 465 has nothing to talk to and will sit there until it times out. Incoming is 993 with SSL/TLS, or 143 with STARTTLS.

The username must be the whole address. you@example.com, not you. This is the single most common cause of a password prompt that never goes away.

The outgoing server needs authentication too, with the same credentials as the incoming one. Clients that leave it off get connected and then refused when they try to send.

Confirm whether the password is really wrong on the mailbox's Login History page. A failed attempt is recorded there with its IP address and protocol. If the attempts are not showing up at all, the client is not reaching the server and this is a port or hostname problem, not a password one.

Sending is being throttled

Mail sits in the outbox, the client reports a temporary failure and tries again later.

Your account is less than 30 days old. Each mailbox is limited to 30 messages an hour and 100 a day for the first 30 days. The Email page shows the days remaining and offers Request an early lift if you are migrating mailboxes.

Nothing is lost. A throttled message is refused temporarily, stays in the client, and most clients retry on their own.

452 4.7.1 Rate limit exceeded

The steady-state limit rather than the new-account one: 1,000 messages an hour and 5,000 a day per mailbox. Spread the send out, or split it across the mailboxes that legitimately own those addresses.

If this is a mailing to a list of recipients, it is the wrong tool. Mass mailings are not permitted on the service.

Your mail is marked as spam

Recipients find your messages in their spam folder, or their server rejects them.

Confirm all three authentication records are published. SPF, DKIM and DMARC are what a receiving server checks, and on the DNS & Setup tab every required record has to read Valid. For DKIM, use the selector shown on its card:

dig +short TXT example.com
dig +short TXT SELECTOR._domainkey.example.com

You are also sending from somewhere else. The SPF record ends in -all, meaning anything not listed in it fails. A shop, a CRM or a newsletter tool sending as your domain has to appear in the same SPF record. If your DNS is hosted here, add their include: to the existing record rather than replacing it; the nightly job merges rather than overwrites, so both survive. Wherever your DNS is, keep it to one SPF record: with two, receivers ignore both.

The domain is new. Receiving servers distrust domains they have never seen before, whatever the records say. Volume built up slowly over a couple of weeks does more for this than any configuration change.

Incoming mail lands in Junk

The message was accepted and delivered, just into the Junk folder rather than the Inbox.

Filter sensitivity is fixed and there is no setting to relax it. What you can do is override it per mailbox: create a filter on the mailbox that matches the sender and files it into the Inbox. See Mailboxes and aliases.

Junk is an ordinary IMAP folder. If it is not visible in your client, subscribe to it in the client's folder list.

An address will not save

The portal reports Email could not be saved. The likely causes, in order:

The address already exists. Addresses are unique across the whole platform, so a mailbox, alias or list anywhere with that name blocks it.

The local part has an unsupported character. Letters, digits, dots and hyphens only.

The password is too weak or too short. Minimum 8 characters, and the form rejects passwords it judges weak beyond that.

An alias points back at itself. A forwarding loop, directly or through another alias, is refused.

The domain is at its ceiling, which is 1,000 mailboxes or 5,000 aliases. See Limits.

What's next

• Setting up a domain for the full DNS record set
• Limits for the numbers behind the rejections above