Reference for tracing mail delivery and diagnosing SMTP transport, SPF, DKIM, DMARC, alignment and reputation.
SMTP ports & roles
- 25/TCP — Server-to-server SMTP. Standard MTA-to-MTA port; often blocked outbound on consumer links.
- 587/TCP — Message SubmissionRecommended submission port for authenticated clients/apps with STARTTLS.
- 465/TCP — Submission TLS impliciteCommonly offered for implicit TLS submission.
- 993/TCP — IMAP sur TLSMailbox access, separate from SMTP sending.
SMTP codes to know
- 2xx — Success. 250 generally means the SMTP step was accepted.
- 4xx — Temporary failure. The sending MTA should normally retry later.
- 550 / 5.1.1 — Recipient rejected or not found. Check recipient address, domain and routing.
- 5.7.x — Policy, authentication or security. Often related to relay, anti-spam, SPF/DKIM/DMARC or permissions.
SPF
- Location — TXT record at the domain root. SPF is a TXT record; multiple separate SPF records make evaluation invalid.
- Example — v=spf1 include:spf.protection.outlook.com -allAuthorizes declared infrastructure and fails other sources.
- DNS lookup limit — A limit of 10 mechanisms or modifiers that cause DNS lookups. include, a, mx, exists and redirect can consume the limit.
- Check — Resolve-DnsName exemple.fr -Type TXTConfirm that a single v=spf1 record is published.
DKIM
- Selector — selector._domainkey.exemple.frAllows multiple keys and rotation without changing the From domain.
- Public key — v=DKIM1; k=rsa; p=…DNS contains the public key; private key stays with the sender.
- Resolve selector — Resolve-DnsName selector1._domainkey.exemple.fr -Type TXTUse the selector shown in the DKIM-Signature header.
- Key rotation — Publish the new key, switch signing, then retire the old key. Keep overlap long enough for messages still in transit.
DMARC & alignment
- Location — _dmarc.exemple.fr TXTDMARC policy is published under _dmarc.
- Policies — p=none | quarantine | rejectOften start with none for visibility before enforcement.
- SPF alignment — MAIL FROM or Return-Path aligned with the visible From domain. SPF pass alone is not enough if the domain is not aligned.
- DKIM alignment — DKIM d= domain aligned with the visible From domain. DMARC passes when at least one aligned mechanism passes.
DNS & connectivity tests
- MX — Resolve-DnsName exemple.fr -Type MXChecks published receiving servers.
- DMARC — Resolve-DnsName _dmarc.exemple.fr -Type TXTChecks policy and reporting addresses.
- SMTP 587 — Test-NetConnection smtp.exemple.fr -Port 587Validates TCP only, not authentication or message submission.
- SMTP TLS — openssl s_client -starttls smtp -connect smtp.exemple.fr:587 -servername smtp.exemple.frInspects certificate and STARTTLS negotiation where OpenSSL is available.
Headers to inspect
- Received — SMTP relay chain. Read bottom-up to reconstruct the delivery path.
- Authentication-Results — The receiving system’s SPF, DKIM and DMARC results. Often the most useful evidence of authentication failure.
- Return-Path — Envelope sender address recorded after delivery. Used for SPF evaluation and bounces.
- Message-ID — Message identifier. Keep it for correlation in message traces.
Troubleshooting order
- 1. Transport — MX + port + code SMTPConfirm delivery reaches the right service before domain authentication.
- 2. Source — IP / Return-Path / HELOIdentify the actual sending source, especially apps and relays.
- 3. Authentication — SPF + DKIM + DMARCCheck pass/fail and alignment with From.
- 4. Reputation/policy — Antispam, blocklist, tenant policyAuthenticated mail can still be blocked by content or reputation.
Key points
- Publish only one v=spf1 SPF record per domain.
- Do not move to p=reject until all legitimate senders are identified.
- Never share a DKIM private key in tickets or web tools.
- Keep full headers from rejected messages; they are often more valuable than screenshots.