IT Toolbox
IT Toolbox

Email & SMTP Center

Email / SMTP / DNS

Email & SMTP Center

Quickly analyze an SMTP error, check MX/SPF/DKIM/DMARC and follow diagnostics for Microsoft 365, Infomaniak, WordPress and SMTP relays.

Analyze un message d’erreur SMTP

Check la configuration DNS email

DNSMX
dig MX exemple.fr +short
DNSSPF
dig TXT exemple.fr +short
DNSDMARC
dig TXT _dmarc.exemple.fr +short
DNSDKIM
dig TXT selector._domainkey.exemple.fr +short
DNSPTR
dig -x 203.0.113.10 +short
SMTPSTARTTLS 587
openssl s_client -starttls smtp -connect smtp.exemple.fr:587 -servername smtp.exemple.fr
SMTPTLS implicite 465
openssl s_client -connect smtp.exemple.fr:465 -servername smtp.exemple.fr
WindowsTester port SMTP
Test-NetConnection smtp.exemple.fr -Port 587
WindowsRésoudre MX
Resolve-DnsName exemple.fr -Type MX
WindowsRésoudre TXT
Resolve-DnsName exemple.fr -Type TXT
Microsoft 365MX tenant
nslookup -type=mx exemple.fr
Microsoft 365Message Trace
Get-MessageTrace -SenderAddress user@exemple.fr -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date)
Exchange OnlineSMTP AUTH org
Get-TransportConfig | Select SmtpClientAuthenticationDisabled
Exchange OnlineSMTP AUTH mailbox
Get-CASMailbox user@exemple.fr | Select SmtpClientAuthenticationDisabled
LinuxTester TCP 587
nc -vz smtp.exemple.fr 587
LinuxTester DNS MX
host -t MX exemple.fr
535

Authentification

Login, mot de passe, SMTP AUTH, MFA/OAuth et politique du fournisseur.

550

Expéditeur / relais

Comparer compte SMTP, MAIL FROM, From et alias autorisés.

587

STARTTLS

Port client SMTP courant avec montée en TLS après EHLO.

465

TLS implicite

Connexion chiffrée dès l’ouverture de session TCP.

SPF

Enveloppe

SPF s’aligne surtout avec MAIL FROM, pas forcément avec le From visible.

DMARC

Alignement

Le domaine visible From doit être aligné avec SPF et/ou DKIM.

Tip : conservez toujours le code SMTP complet et le sous-code (ex. 550 5.7.1 ou 535 5.7.139). Ils orientent beaucoup plus vite vers la bonne cause.
Field troubleshooting

Center mission

8 playbooks

Trace a message end to end: DNS, SMTP connection, authentication, anti-spam policy, SPF/DKIM/DMARC and final delivery, using real codes and headers.

Quick triage

  • Collect sender, recipient, time, subject and exact NDR/SMTP code.
  • Determine whether message left the source server.
  • Check MX then TCP 25/587 connectivity depending on scenario.
  • Analyze headers from a comparable received message.
  • Separate SMTP authentication from domain authentication via SPF/DKIM/DMARC.

Decision tree

Immediate 5xx→

Address permanent code before retrying.

4xx / delay→

Inspect queue, reputation and remote-server response.

Delivered but spam→

Analyze SPF/DKIM/DMARC, reputation and content.

Only application SMTP fails→

Check auth, TLS, port, relay and sender identity.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01SMTP 550 / permanent rejectionRead-only
Symptom

550 NDR, recipient or policy permanently rejects message.

Checks

  • Read full enhanced code and remote text.
  • Check recipient existence and source reputation/domain.
  • Analyze SPF/DKIM/DMARC if referenced.

Commands / evidence

nslookup -type=mx <domaine>nslookup -type=txt <domaine>Test-NetConnection <mx> -Port 25

Expected result

550 is tied to a precise cause: address, policy, reputation or authentication.

Corrective actions

  • Fix the indicated cause, not the generic symptom.
  • Avoid broad allowlists until source is authenticated.

Escalate when

Rejection comes from third party and persists despite correct DNS/auth configuration.

02535 / SMTP authentication errorControlled change
Symptom

Application or scanner receives 535, auth failed or invalid credentials.

Checks

  • Confirm port 587/465 and expected TLS mode.
  • Check account, password and SMTP AUTH permission.
  • Identify MFA/modern-auth incompatibility with client.

Commands / evidence

Test-NetConnection <smtp> -Port 587openssl s_client -starttls smtp -connect <smtp>:587nslookup <smtp>

Expected result

TLS connection is established and server accepts intended authentication method.

Corrective actions

  • Prefer relay/connector or OAuth when client does not support required method.
  • Do not disable MFA globally for one device.

Escalate when

Legacy client incompatible with tenant requirements or organization-wide security change is required.

03SPF failureControlled change
Symptom

Header or DMARC report shows SPF fail/softfail for a legitimate source.

Checks

  • List all legitimate sending sources for domain.
  • Check single SPF TXT and include/ip4/ip6 mechanisms.
  • Check 10-DNS-lookup limit.

Commands / evidence

nslookup -type=txt <domaine>nslookup -type=txt <include-domain>

Expected result

One SPF policy covers legitimate source without exceeding DNS limits.

Corrective actions

  • Add source minimally then validate full resolution.
  • Remove duplicates/old includes only after inventory.

Escalate when

SPF exceeds limits, multiple unmanaged providers or highly exposed domain.

04DKIM failureControlled change
Symptom

dkim=fail, selector missing or invalid signature.

Checks

  • Identify selector and d= domain in header.
  • Resolve selector._domainkey.
  • Compare published key and signing service.

Commands / evidence

nslookup -type=txt <selector>._domainkey.<domaine>openssl s_client -connect <smtp>:25 -starttls smtp

Expected result

Public key is published and message signature validates.

Corrective actions

  • Fix selector/TXT or enable signing at provider.
  • During rotation, keep required selector coexistence.

Escalate when

Provider signs with unexpected domain or multi-platform key rotation.

05DMARC failureControlled change
Symptom

dmarc=fail or reports show legitimate unaligned sources.

Checks

  • Check From alignment with SPF or DKIM.
  • Read p, pct, rua/ruf policy.
  • Identify legitimate sources before enforcement.

Commands / evidence

nslookup -type=txt _dmarc.<domaine>nslookup -type=txt <domaine>

Expected result

At least SPF or DKIM passes with From-domain alignment.

Corrective actions

  • Fix source alignment before increasing p=quarantine/reject.
  • Use aggregate reports to measure impact.

Escalate when

Many uninventoried sources or move to reject affects critical business flows.

06Delayed message / queueRead-only
Symptom

Message arrives minutes/hours late or stays queued/deferred.

Checks

  • Identify hop where delay appears in Received headers.
  • Read 4xx response and retry schedule.
  • Check saturation, greylisting or reputation.

Commands / evidence

nslookup -type=mx <domaine>Test-NetConnection <mx> -Port 25tracert <mx>

Expected result

Delay is attributed to a specific server/hop and identifiable temporary response.

Corrective actions

  • Address queue/reputation/connectivity according to responsible hop.
  • Keep message-id and timestamps for correlation.

Escalate when

Mass delays, growing queue or remote service temporarily rejects entire domain.

07Relay denied / 5.7.xControlled change
Symptom

Server refuses relay for application, printer or external domain.

Checks

  • Determine whether scenario should authenticate or be authorized by IP/connector.
  • Check sender, domain and destination.
  • Check relay restriction to avoid open relay.

Commands / evidence

Test-NetConnection <smtp> -Port 25Test-NetConnection <smtp> -Port 587nslookup -type=mx <domaine>

Expected result

Relay is authorized only for intended source or identity.

Corrective actions

  • Create the narrowest possible authorization.
  • Verify unauthorized source remains denied.

Escalate when

Multi-site relay requirement, shared NAT or open-relay risk.

08Reverse DNS / reputationControlled change
Symptom

Mail is rejected or spammed despite correct SPF/DKIM.

Checks

  • Check outbound IP PTR and HELO/EHLO consistency.
  • Confirm actual public outbound IP.
  • Check blacklists/reputation through recognized providers.

Commands / evidence

nslookup <IP_PUBLIQUE>nslookup <PTR_NAME>tracert <mx-distant>

Expected result

PTR exists, maps to a coherent name and IP has no abnormal reputation issue.

Corrective actions

  • Have PTR fixed by IP owner and align HELO where possible.
  • Address abusive sending cause before delisting request.

Escalate when

Shared IP, carrier reputation or large-provider block with no local control.

End-of-intervention checklist

  • Retest a real message with recorded message-id and time.
  • Verify SPF, DKIM and DMARC in new headers.
  • Confirm Inbox/Spam delivery as appropriate.
  • Document any DNS change and TTL.
  • Monitor DMARC reports or queues after change.

Continue in BAOI

Related cheat sheetSMTP / SPF / DKIM / DMARC IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.

See also:. SMTP.

See also:. SMTP 535 5.7.3.

♡ 0