ShowDNS Errors
Paste the Error,
Get the Fix
Clear, actionable solutions for the exact DNS, SSL/TLS, certificate, and email errors you hit in the terminal and browser — with the diagnostic commands and tools to confirm the fix.
Featured fixes
Fix "CAA record prevents issuance" (Let's Encrypt & ACME)
Why certificate authorities reject issuance with a CAA error, and how to add the right issue/issuewild tag so Let's Encrypt, ZeroSSL, and other CAs can issue.
FeaturedFix "Message rejected due to DMARC policy" (dmarc=fail)
Why mailbox providers bounce email with dmarc=fail, and how to fix SPF and DKIM alignment so your messages pass your domain's DMARC policy and reach the inbox.
FeaturedFix "No DMARC record found"
Why lookups report a missing DMARC policy even when you published one, and how to publish the _dmarc TXT record so receivers and checkers actually find it.
FeaturedFix "Passes SPF but fails DMARC" (alignment failure)
spf=pass next to dmarc=fail means SPF authenticated the wrong domain. Diagnose the Return-Path mismatch and fix alignment with a custom return path or DKIM.
FeaturedFix "og:image not showing" on Facebook & LinkedIn
Why a declared og:image still renders as a blank or text-only card — size floors, undeclared dimensions, blocked crawlers, mixed content, and the scrape cache.
FeaturedFix "535 5.7.8 Username and Password not accepted"
Why SMTP rejects credentials that look correct — app passwords, the literal "apikey" username, region-specific SES keys, and Microsoft 365 blocking SMTP AUTH.
SSL
1Email Security
12Fix "Message rejected due to DMARC policy" (dmarc=fail)
Why mailbox providers bounce email with dmarc=fail, and how to fix SPF and DKIM alignment so your messages pass your domain's DMARC policy and reach the inbox.
Fix "No DMARC record found"
Why lookups report a missing DMARC policy even when you published one, and how to publish the _dmarc TXT record so receivers and checkers actually find it.
Fix "Passes SPF but fails DMARC" (alignment failure)
spf=pass next to dmarc=fail means SPF authenticated the wrong domain. Diagnose the Return-Path mismatch and fix alignment with a custom return path or DKIM.
Fix "SPF PermError: too many DNS lookups" (10-lookup limit)
Why SPF returns PermError when your record needs more than 10 DNS lookups, and how to remove unused senders, drop a/mx/ptr, and flatten includes to get back under the limit.
Fix "DKIM signature verification failed" (dkim=fail)
Why receivers return dkim=fail with a bad signature or body hash mismatch, and how to fix the published key, selector, and message handling so DKIM verifies and passes.
Fix "blocked using Spamhaus" — sending IP blacklisted
Why mail bounces with "blocked using Spamhaus" or an RBL, how to find which blacklist lists your sending IP, and how to fix the cause and request delisting so mail flows.
Fix "dkim=none" — message not signed with DKIM
Why receivers report dkim=none (message not signed), why it weakens DMARC and deliverability, and how to enable DKIM signing and publish the selector so your mail is signed.
Fix "Received-SPF: softfail" (~all) — SPF Not Passing
Why mail is spammed or rejected on SPF softfail (~all) or neutral (?all), what the SPF qualifiers mean, and how to authorize the sender so SPF passes instead of soft-failing.
Fix "550 5.7.1 Relaying denied" (not permitted to relay)
Why SMTP servers reject mail with 550 5.7.1 Relaying denied, covering the sender-authentication and MX-routing causes, and how to fix each so mail is accepted.
Fix "550 5.1.1 User unknown" (recipient address rejected)
Why mail bounces with 550 5.1.1 User unknown or recipient address rejected — a mistyped address, a deleted mailbox, or stale MX routing — and how to fix each cause.
Fix "535 5.7.8 Username and Password not accepted"
Why SMTP rejects credentials that look correct — app passwords, the literal "apikey" username, region-specific SES keys, and Microsoft 365 blocking SMTP AUTH.
SPF Not Working on Cloudflare
Why SPF fails when the Cloudflare record looks correct — a duplicate published by Email Routing, a/mx mechanisms resolving to proxy addresses, and non-authoritative zones.