Seeing an email authentication error?

This error means evaluating your SPF record requires more than 10 DNS lookups (the hard limit in the SPF standard), so receiving servers give up and treat your SPF as permanently broken.

This error means the message body was modified after your server signed it: the hash the receiver computes no longer matches the hash in your DKIM signature, so the signature is rejected.

This bounce means Gmail rejected your message because it passed neither SPF nor DKIM. Google now refuses mail it can't authenticate at all.

This header means the message failed DMARC against a p=reject policy, and Microsoft chose to override the reject (“oreject”), delivering it to junk or quarantine instead of bouncing it.

SPF softfail means the sending server's IP isn't authorized by your SPF record, and your record ends in ~all, which tells receivers “treat this as suspicious, but don't reject it outright.”

This bounce means the receiving server tried to look up and evaluate your DMARC policy and hit a permanent error: it couldn't make sense of what your DNS returned, so it rejected the message rather than guess.

This banner means Gmail's filters were suspicious of the message, but the sending domain's DMARC setup (typically a p=none policy or a passing DMARC result) instructed Gmail to deliver it to the inbox instead of spam.

If your mail started landing in Gmail spam folders, you're almost certainly missing one of Google's sender requirements (enforced since February 2024), which demand authenticated mail from everyone and SPF, DKIM, DMARC, one-click unsubscribe, and a low spam rate from bulk senders.