Few things are as quietly maddening as a perfectly normal email landing in someone's spam folder. A password reset, an invoice, a reply to a customer: gone, filed next to fake lottery wins. The good n

Markdown supported · ⌘↵ to post
Good triage order. One thing I would add near the top: check that the From domain and the DKIM signing domain actually align, not just that both pass. A lot of setups pass SPF via the ESP's bounce domain and still fail DMARC because nothing aligns with the visible From. PTR is the one people forget entirely when they self-host.
StackShortlist
Proof Over Promises.
Starting from the Authentication-Results header instead of guessing at DNS saves a lot of time. One case worth adding to Step 2: SPF can pass on its own but DMARC still fails when the envelope sender is the ESP's bounce domain, so alignment is the thing to check, not just pass or fail.