Error Messages

The receiving server checked your domain's SPF record and did not find the sending IP in it. Because your record ends in -all, that is an explicit rejection.

Your SPF record exceeds the limit of 10 DNS-querying mechanisms. The consequence is not “partially valid” but: SPF counts as unevaluable — for all your mail, including from your main server.

DMARC passes only when SPF or DKIM passes and the domain it checked aligns with the domain in the From: header. That second condition — alignment — is almost always the reason for this message.

This message says something very specific: the key was found, the signature is formally fine — but the message body is no longer the same as when it was signed. Something along the way touched it.

The receiver read the signature, looked for the matching public key in DNS — and found nothing. The fault is almost always in DNS, not in the mail server.

The message usually names the list that triggered it. That is the most valuable piece of information in it — because lists differ enormously in how much they matter.

The first digit decides: 4xx is temporary, the message is not lost. Your server will try again. A persistent 421 is still a warning sign — it is practically always about reputation.

This rejection almost exclusively hits self-hosted mail servers. The receiver looks the sending IP up in reverse and finds no name — or one that does not confirm going forward.