Full Diagnostic Tree & Step-by-Step Overview
What specific email problem are you currently experiencing?
- Outbound emails fail to send, bounce back with error codes, or get stuck in Outbox
- Incoming emails are delayed, not appearing, or IMAP/POP3 sync keeps failing
- Unable to log in, password rejected, 2FA/OAuth loops, or account security blocks
How are outbound emails failing when you try to send them?
- Emails bounce back immediately with error codes like 550, 5.7.1, SPF/DKIM failure, or blacklisting
- Emails sit stuck in Outbox, or client throws SMTP connection timeout / SSL handshake errors
Audit Domain DNS Records (SPF, DKIM, DMARC) and Remove IP Blacklist
Solution:
Root Cause: SPF/DKIM/DMARC Authentication Failure or Sender IP Blacklisting
Receiving mail servers reject outbound messages with 550 5.7.1 or similar NDR bounce errors when domain DNS records (SPF, DKIM, DMARC) are missing, improperly formatted, or when the sending IP/domain is listed on anti-spam DNSBL blocklists.
# Step-by-Step Fix:
Verify Domain SPF and DMARC Records:Open Terminal or Command Prompt and run: bash
nslookup -type=TXT yourdomain.com
Ensure your SPF record includes your mail provider (e.g., v=spf1 include:_spf.google.com ~all or include:spf.protection.outlook.com).Validate DKIM Signing:Verify that your DNS provider has selector CNAME records active (e.g., google._domainkey.yourdomain.com).Check Sender IP Against Spam Blocklists:Query MXToolbox or Spamhaus with your outbound mail server IP.Submit a delisting request if your IP was flagged due to recent outbound spam spikes.Correct Sender Address Alignment:Ensure the 'From' header address exactly matches the authenticated SMTP user account.
Reconfigure Outbound SMTP Settings, Ports, and Encryption Protocols
Solution:
Root Cause: Misconfigured SMTP Port, SSL/TLS Encryption, or ISP Port 25 Block
Emails remain stuck in the client Outbox when the mail client cannot establish a secure TCP socket with the remote SMTP server, often caused by blocked port 25, incorrect authentication settings, or SSL/TLS protocol mismatches.
# Step-by-Step Fix:
Test Port Reachability via Command Line:Open Terminal or PowerShell and test connection to your SMTP server (e.g., smtp.office365.com or smtp.gmail.com): bash
Test-NetConnection -ComputerName smtp.office365.com -Port 587
Update SMTP Server Configuration:Set SMTP Server Port to 587 with STARTTLS (or port 465 with SSL/TLS).Never use unencrypted Port 25 as most residential and commercial ISPs block port 25 outbound.Enable SMTP Authentication:Check the box My outgoing server (SMTP) requires authentication in your email client settings.Select Use same settings as my incoming mail server.Disable Antivirus Email Shield Scanning:Temporarily disable third-party antivirus mail scanning hooks, which frequently intercept and break SSL handshake attempts.
What pattern of failure are you observing with incoming messages?
- Senders report non-delivery bounce errors (550 Mailbox Full or MX record lookup failure)
- Email client fails to sync folders, displays IMAP/POP3 offline status, or requests password continuously
Purge Over-Quota Storage and Fix Domain MX DNS Records
Solution:
Root Cause: Exceeded Mailbox Quota or Missing Domain MX Records
When senders receive bounce notifications stating 'User mailbox is over quota' or 'Host or domain name not found', incoming mail servers either lack routing instructions (MX records) or the target account has filled its cloud storage allocation.
# Step-by-Step Fix:
Inspect Domain MX Records:Run a DNS lookup to ensure MX records point to your designated mail gateway: bash
nslookup -type=MX yourdomain.com
Verify there are no duplicate or leftover MX records pointing to old hosting servers.Clear Cloud Storage Allocation:Log directly into webmail (e.g., Gmail, Outlook Web, cPanel Webmail).Permanently purge items in Trash, Spam/Junk, and Deleted Items folders to free up storage.Expand Mailbox Storage Quota:If using Google Workspace or Microsoft 365, upgrade user license tier or increase individual mailbox limits in administrative settings.
Repair IMAP/POP3 Server Settings and Rebuild Mailbox Index
Solution:
Root Cause: Incorrect IMAP/POP3 Port Settings or Corrupted Local Data Cache
Incoming mail sync failures occur when incoming ports/security protocols are misconfigured in the client, or when the local offline message database file (.ost / .pst / MBOX) becomes fragmented or corrupted.
# Step-by-Step Fix:
Verify Incoming Mail Server Port & Security:IMAP: Set Server Port to 993 with SSL/TLS encryption.POP3: Set Server Port to 995 with SSL/TLS encryption.Reset IMAP Root Folder Path:In client Account Settings, locate Advanced options.Set Root folder path explicitly to INBOX (common requirement for cPanel, iCloud, and custom IMAP servers).Rebuild Local Mailbox Index (.OST/.PST Repair):Outlook: Close Outlook, run SCANPST.EXE from your Office installation folder, and repair the data file.Thunderbird / Apple Mail: Right-click the problem folder > select Properties > click Repair / Rebuild.
What specific login or authentication block are you encountering?
- Password rejected on desktop/mobile client despite working in webmail (OAuth 2.0 or App Password required)
- Stuck in 2FA/MFA verification loop, webmail SSL certificate warnings, or tenant admin access lock
Generate Provider App Password or Migration to Modern OAuth 2.0 Authentication
Solution:
Root Cause: Legacy Basic Authentication Deprecation or Missing App Password
Major providers (Google Workspace, Microsoft 365, Yahoo) have permanently disabled legacy 'Basic Authentication' (plain username/password over IMAP/SMTP). Third-party mail clients using basic credentials will reject valid passwords until configured with OAuth 2.0 or dedicated App Passwords.
# Step-by-Step Fix:
Generate a Dedicated App Password (If 2FA is Enabled):Log into your email provider security console (e.g., Google Account Security or Microsoft Security Defaults).Navigate to 2-Step Verification > App Passwords.Generate a 16-character single-use App Password and enter it into your email client in place of your standard password.Switch Client to Modern Authentication (OAuth 2.0):Remove and re-add the email account in your client using the automated setup wizard (select Google or Exchange/Microsoft 365 instead of manual IMAP/POP3).Clear Stored Windows Credential Manager Tokens:Press Win + R, type control /name Microsoft.CredentialManager, and press Enter.Under Windows Credentials, remove stale entry records matching your mail server domains.
Reset Authentication Tokens, Clear Browser Cache, and Verify Server SSL Certificate
Solution:
Root Cause: Invalid Webmail SSL Certificate, Corrupted Auth Session, or MFA Lockout
Webmail login loops and browser certificate warnings happen when the mail server's TLS/SSL certificate is expired/untrusted, or when local browser session cookies and MFA hardware tokens get desynchronized.
# Step-by-Step Fix:
Bypass Local Browser Cache and Cookie Locks:Open Webmail in a private/incognito window.If webmail loads cleanly, clear your main browser's cookies and site storage for your mail domain.Inspect Webmail SSL/TLS Certificate:Click the padlock icon in your browser address bar when visiting webmail.If a certificate warning appears, verify if the domain name on the certificate matches your mail server host (e.g., webmail.yourdomain.com).Re-sync Multi-Factor Authentication (MFA) Time Clock:If TOTP authenticator codes are rejected, open your Authenticator app settings and select Time correction for codes > Sync now.Revoke and Re-issue OAuth Sessions (Admins):In Microsoft Entra ID or Google Admin Console, locate the affected user and select Revoke Sign-in Sessions.