Troubleshoot mail

Find the symptom or the message you see, then follow the fix. Messages appear here exactly as the dashboard, webmail, your mail app or your application shows them. Each fix links to the page that covers the task in full, and that page's troubleshooting section lists the rest of its messages.

After Verify now, the toast says example.com is still pending: followed by the first problem the check found. The domain's page shows the result of each check in the Checks row, and what the last check found in the Last problem row. A Mail Hosting domain needs Ownership, MX, SPF and DKIM to pass. An SMTP Relay domain needs Ownership, SPF and DKIM (When a domain is verified).

some records are not in place yet

The check found a record missing or different, and has no message that names it. The record is the ownership record at _mailverify.example.com, the SPF record, or, on Mail Hosting, any MX record at all. A record you created moments ago may not be served yet, or it may hold a typing mistake. Compare each record at your DNS provider with the DNS records card, where the Status column shows Missing for each needed record the last check did not find. What each check looks for gives the rule for each record.

MX points to followed by other hosts

On Mail Hosting, the domain's MX records name another provider, so the domain cannot verify. Replace them with the ones on the DNS records card. If the domain receives mail somewhere else today, follow Move a domain that already receives mail first. On SMTP Relay, this is information only. The toast can still name it first while another check keeps the domain pending, so read the Checks row.

DKIM selector cor202609r not published or No DKIM keys yet: the mail engine has not made them

We make the domain's two DKIM keys once the ownership check passes. Reload the domain's page to see the two DKIM records, then publish each value whole. When the keys do not exist yet, select Verify now again in a minute.

The mail engine holds example.com for another service

Another mail service on our servers already uses the domain, so we cannot set it up on this one. The message stays in the Last problem row while that lasts. If the other service is yours, remove the domain there first (Remove a domain), and the next check sets it up here. Otherwise, contact support and name the domain.

Two SPF records are published at example.com; only one may exist

A domain can have only one SPF record, and receiving servers treat two as broken. Delete both and publish the one value the DNS records card shows: it keeps your other senders and adds ours. In a zone on Coritan DNS we do this for you.

The SPF record needs 12 DNS lookups; the limit is 10

Receiving servers stop at 10 DNS lookups and then fail SPF. Remove senders you no longer use from the record. In a zone on Coritan DNS we keep your senders only while the record stays within the limit, and drop the ones past it.

A CNAME at _dmarc.example.com blocks the record there. Delete the CNAME, then publish the record we show.

A name that holds a CNAME cannot hold a TXT record. The same message names a CNAME at the domain, at a DKIM selector or at our delivery partner's key. In a zone on Coritan DNS we delete the CNAME for you.

Our delivery partner's DKIM key is not published at followed by a name

Mail from this domain leaves through our delivery partner, and its signing key is the second DKIM record on the DNS records card. Publish it at that name. The domain stays pending until it is there.

We could not read your DNS just now. We will check again soon.

The check could not reach your DNS. A verified domain stays verified. Select Verify now again in a few minutes.

DMARC publishes p=none, expected p=quarantine

The DMARC record holds a different stage from the one we expect. A domain verifies without DMARC, so this does not keep it pending. How the DMARC stage ramp works explains how to bring the two in line.

A verified domain is pending again

Selecting Verify now checks a verified domain again, and a required record that has gone, such as the ownership record, sets it back to pending. Put the record back, then select Verify now. Keep the ownership record in place for as long as the domain is on the service.

After you fix a record, select Verify now again. We ask your domain's own nameservers, so a record counts as soon as your DNS provider serves it. We also check pending domains about every ten minutes. The messages you can get while adding a domain, such as That domain is already attached to a mail service, are in Add a domain to Mail Hosting and Add a sending domain to SMTP Relay.

Check these in order. They apply to Mail Hosting mailboxes and to your coritan.gg mailbox, except where a cause names Mail Hosting.

The domain's MX records point to another provider

Other servers deliver the domain's mail wherever its MX records point. On Mail Hosting, the domain then stays pending with MX points to followed by the other hosts, or, for an older domain, shows Sending only. Replace the MX records with the ones on the DNS records card. After the change, servers that already queued mail for the old hosts can still deliver it there for a while, so check the old mailboxes for a few days.

The address has no mailbox or alias

Mail to an address on a Mail Hosting domain that is neither a mailbox nor an alias bounces back to the sender, unless the domain has a catch-all. Check the spelling with the sender, or create an alias for the address. An alias whose only mailbox was deleted delivers nowhere. Forward addresses with aliases covers both.

The mailbox cannot receive mail

A mailbox that is turned off cannot receive mail. Neither can the mailboxes of a Mail Hosting service that is suspended for an unpaid invoice, or whose sending we paused. The mailbox's Enabled switch on the Mailboxes tab and the Status on the service's Service card show which applies. See Turn a mailbox off or on, When a payment is late and Sending paused.

The mailbox is full

A mailbox cannot store more mail than its quota. The line at the bottom of the folder list in webmail shows how much of its storage the mailbox uses. Delete mail you no longer need. On Mail Hosting, you can also give the mailbox a larger quota (Change a mailbox's quota).

The message is in Spam, or a filter moved it

The mail server files mail it takes for spam in Spam. Select Not spam to move a message back to the Inbox and add its sender to your contacts, whose mail passes the spam filter when it passes DMARC (Get mail out of Spam). Mail from a blocked sender goes straight to Spam. A filter can move mail to another folder, forward it or discard it as it arrives (What a filter can do). Forwarding all mail can archive or delete the copy in this mailbox (Forward all mail). To search every folder except Spam and Trash, add in:all to the search.

Find out what happened to the message first. On SMTP Relay, the Events tab lists each step of each delivery, up to 90 days back (Look up message events). On Mail Hosting, the Recent activity card on the Overview tab shows the latest eight events from the last seven days. Some bounces reach the sending mailbox only as an Undelivered Mail Returned to Sender message. The event says what to do next:

rejected, or no event at all

We refused the message when it was sent, and the reply your application or mail app got says why. See A message is refused when you send it. A message sent in the last minute or so may not have its events yet.

accepted with nothing after it

The message is still in the queue, or the receiving server has not answered yet. Check again later.

deferred

The receiving server refused the message for now, or a sending limit held it back. We try again later. Response shows the receiving server's reply, when it gave one. For a sending limit, see Mail goes out slowly.

bounced

The message was not delivered, and we will not try again. Response shows the receiving server's reply, when it gave one. We also added the recipient to the suppression list, so we refuse further mail to it (A recipient is suppressed).

delivered

The receiving server took the message. Ask the recipient to look in their spam folder, and see Mail you send goes to spam.

Mail providers decide where a message goes from how it is signed and from how recipients treat your mail. On SMTP Relay, the Deliverability card on the Overview tab has a check for each of these except the message category and the shared addresses (The checks).

The message fails SPF or DKIM

Both pass only while the sending domain's records match the DNS records card. Keep one SPF record for the domain, with our include: in it (and our delivery partner's, when the card shows one), and publish every DKIM record whole (What each check looks for). On SMTP Relay, the SPF and DKIM check fails when a verified domain is missing either record.

The DMARC record is missing or out of date

The DMARC check fails when a verified domain's DMARC record is missing or holds another stage. Publish the record that the DNS records card shows. How the DMARC stage ramp works explains the stages.

Bulk mail goes out as transactional

Gmail and Yahoo ask for one-click unsubscribe headers on bulk mail, and the relay adds them only to marketing mail. Send newsletters and campaigns as marketing. Over SMTP, the relay adds the headers only to a message with one recipient, so send bulk mail one message per recipient, or add your own List-Unsubscribe headers (What marketing adds).

Recipients report your mail as spam, or it bounces

The Bounces and complaints check warns from 2% bounces or 0.1% complaints, which is what Gmail asks of senders. The same rates decide whether we pause your sending (When sending pauses). Bring the rates down lists what helps.

The addresses your mail leaves from have a poor reputation

We manage the shared addresses and watch their reputation, so you have nothing to check there. If you think they are the cause, contact support. Mail from a dedicated address depends on your own sending alone.

A Mail Hosting service has no Deliverability card. Its rates are in the reputation report of the API (Sending reputation and deliverability), and each domain's page shows its records on the DNS records card.

These apply to Mail Hosting mailboxes and to your coritan.gg mailbox. For an application that sends through SMTP Relay, see Send over SMTP with credentials.

The username is not the whole address

Use the mailbox's full address, such as alex@example.com, as the username for both servers.

Two-factor authentication is on for the mailbox

A mail app cannot send a code, so it needs an app password in place of the mailbox's password. Whoever manages a Mail Hosting service can create one in the dashboard (Create an app password). The mailbox's user can create one in webmail (Create an app password).

The password changed

After a password reset or a new mailbox password, enter the new password in every app that signs in with it. Apps that use an app password keep working. Your coritan.gg mailbox uses your Coritan account password until you give it one of its own, so changing your account password changes it too (The mailbox password).

The mailbox cannot sign in at all

A mailbox that is turned off cannot sign in. Neither can the mailboxes of a service that is suspended or whose sending we paused. Check the mailbox's Enabled switch on the Mailboxes tab, and the service's Status.

Too many failed sign-ins

After 30 failed sign-ins in an hour from one IP address, the mail server refuses that address for 24 hours. Fix the password in every app that uses the mailbox, then wait for the block to end.

The app cannot connect, or warns about a certificate

Copy the server names from the Mail server addresses card on the service's Overview tab, or from the Mail apps tab of webmail settings. IMAP uses port 993 with SSL/TLS. SMTP uses port 587 with STARTTLS, or port 465 with SSL/TLS. A name under your own domain, such as imap.example.com, does not match the certificate, and many networks block port 25.

Connect a mail app to Mail Hosting and Set up mail apps and devices cover the rest, such as a message too large to send.

Over SMTP, a refusal is a reply that your application logs or your mail app shows. A mailbox gets the same replies as an SMTP Relay credential, apart from the monthly allowance, which only SMTP Relay has. Send over SMTP with credentials explains each reply in full.

550 5.7.1 Sender domain example.org is not verified on this account

The envelope sender, the address in MAIL FROM, is not on a domain whose ownership the service has proved. Send from an address on one of the service's domains.

550 5.7.1 From address must use a verified domain, not example.org

The From header is on a domain the service has not proved. Change the From address, or add the domain.

550 5.7.1 Sending is not available for this account

The credential or the mailbox is turned off, or the service is not active. Turn it back on, or check the service's status on the Overview tab.

550 5.7.1 Sending is paused for this account; contact support

We paused the service's sending. See Sending is paused or under review.

550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue or 550 5.7.1 Monthly sending allowance reached; upgrade the plan to continue

The relay has sent everything its plan allows this month. See The relay stops sending for the month.

550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint

The recipient is on the service's suppression list. See A recipient is suppressed.

550 5.7.1 This login is not a mail account we know

The credential belongs to a relay that no longer exists. Create a credential on an active relay.

501 5.5.4 You are not allowed to send from this address.

The address in MAIL FROM is neither the mailbox's or credential's own address nor one of its aliases. Send from that address.

550 5.7.1 Send from this mailbox's own address, alex@coritan.gg or 550 5.7.1 The From address must be this mailbox's own, alex@coritan.gg

A coritan.gg mailbox sends only as itself, in MAIL FROM and in the From header. Set the address in your mail app to the mailbox's own.

451 4.7.1 This mailbox has sent to its limit of 20 recipients this hour; try again later or 550 5.4.5 This mailbox has sent to its limit of 50 recipients in 24 hours

Your coritan.gg mailbox has reached one of its sending limits. The hourly count starts again at the top of the hour. The 24-hour count goes down as the hours of earlier mail pass.

550 5.7.1 Your account is not authorized to use this service. when a mail app signs in to send, or 550 5.7.1 Sending from this mailbox is on hold; contact support

Your coritan.gg mailbox is on hold: it signs in and receives, and sends nothing (When we pause or hold the mailbox). Contact support to have the hold lifted.

550 5.7.1 The sender name may not be Apple. Send under your own name, or a 550 5.7.1 reply that says the message links to a site, names a brand, has a link that shows one site and goes to another, matches mail we blocked as spam, or that our spam filter scored it

We read every message a coritan.gg mailbox sends, and this one broke one of the rules. Change what the reply names, then send again. A mailbox that sends under a brand's name, links to a listed site or sends mail we blocked is also paused.

550 5.7.1 This mailbox is new, so it sends from webmail only for now, 550 5.7.1 A mail app cannot send from this mailbox over a hosting, VPN, proxy or Tor network or 550 5.7.1 Mail cannot be sent from this network

A coritan.gg mailbox sends from webmail only in its first 14 days, and from a mail app after that only off hosting, VPN, proxy and Tor networks. The last reply means we stopped mail from the network you are on. Send from webmail, or from another network.

452 4.5.3 One message from this mailbox can go to at most 10 recipients

The message has more recipients than a coritan.gg mailbox may send one message to. Send to the others in another message.

452 4.4.5 Rate limit exceeded, try again later.

The mail server's own limit on the recipients a coritan.gg mailbox sends to in an hour or a day, which holds when our other checks cannot answer. Wait, then try again.

452 4.3.1 Mail system full, try again later.

Too much of the service's mail is waiting to go out (Mail goes out slowly). A coritan.gg mailbox gets this reply once 50 of its own messages are waiting. Wait for them to go, then try again.

The send API answers the same causes with an HTTP status and a detail, such as 400 example.org is not a domain on this service or 400 Sending is paused on this service; contact support. Send email over HTTPS lists each one. In webmail, a refused message opens again in a compose window, with a message that starts Could not send the message: and the reason (Write and send email in webmail).

Over SMTP, we refuse the address with 550 5.1.1 Recipient alex@example.com is suppressed after a bounce or complaint and accept the other recipients. The send API leaves the address out, sends to the others and lists the address in suppressed in its answer (Read the answer).

Cause

We add an address to the service's suppression list when a message to it bounces, when its recipient reports a message as spam, and when they unsubscribe from marketing mail. You can add addresses too. The reply names a bounce or complaint whatever the reason.

Fix

On the relay's Suppressions tab, find the address. Its Reason says how it got there (Why an address is on the list). Remove it with Release… only once the problem is fixed, or once someone who unsubscribed asks to hear from you again (Remove an address). The tab lists only the 200 most recent entries. A Mail Hosting service has a suppression list too, which you manage through the API (On a Mail Hosting service).

Over SMTP, the relay answers 550 5.7.1 Monthly allowance and its 12% buffer are used up; upgrade the plan to continue, or 550 5.7.1 Monthly sending allowance reached; upgrade the plan to continue on the free plan. The send API answers 429 with the same text. The Overview tab shows Sending has stopped for this month, and we email your account's address.

Cause

The relay has used its monthly allowance, including the buffer on a paid plan. We check the count plus the recipients of the message in hand, so a message to many recipients can be refused while a message to one recipient still goes out.

Fix

Sending starts again at 00:00 UTC on the 1st. To raise the allowance before then, contact support. Change plan on the alert opens the Billing tab, which cannot move a relay to a larger plan. On the free plan, you can order a paid relay instead (The free SMTP Relay plan). What happens near the allowance lists the warnings we send before this point.

Cause

A relay sends at most its hourly limit in an hour. Mail over it waits in the queue and goes out in a later hour, and the Events tab can show deferred events for it meanwhile. Once six hours of mail at the hourly limit is waiting, we refuse new messages until the queue shrinks. A dedicated address in warm-up also has an hourly cap of its own, which can be lower than the relay's limit. A Mail Hosting service has an hourly limit too, and mail over it waits in the same way.

Fix

Spread large sends over time. The Hourly limit card on the relay's Overview tab shows the Current limit and the Next step. The limit rises on its own as the relay sends clean mail (How the limit rises). To go higher sooner, select Request limit increase… (Request a higher hourly limit). Plan large sends from a dedicated address for after its warm-up.

Above the service's tabs, the Under review or Sending is paused alert shows the rates that set it off, such as auto-frozen: 11.4% bounces, 0.08% complaints over 7d. We do not email you about either.

Cause

The service's bounce or complaint rate over the last seven days (never above 100%) reached a line: 5% bounces or 0.1% complaints for a review, and 10% bounces or 0.5% complaints for a pause. Our staff can also pause a service by hand. Under review, sending carries on. While sending is paused, relay credentials cannot sign in, and the send API answers 400 Sending is paused on this service; contact support. On Mail Hosting, the mailboxes cannot sign in, send or receive mail.

Fix

Find and fix what caused the bounces or complaints (Bring the rates down). Only our staff lift a pause or clear a review, so then contact support and say what you changed. If the rates of the last seven days are still at a pause line when our staff lift the pause, the next check pauses sending again (Sending paused).

When webmail at www.coritan.com/webmail cannot open a mailbox, it shows Could not open your mailbox, the reason under it, and Try again.

This mailbox is disabled.

The mailbox is turned off. Whoever manages a Mail Hosting service turns it back on with the mailbox's Enabled switch (Turn a mailbox off or on). When we turned the mailbox off because it suddenly sent far more mail than usual, the reason says what we saw instead, such as how many people it sent to in an hour. Reset its password, then turn it back on (Create and manage mailboxes). For your coritan.gg mailbox, contact support.

The mail service is not reachable right now.

The mail server that holds the mailbox did not answer. Select Try again after a moment, and contact support if it keeps happening.

Another reason

Select Try again. If the same reason comes back, contact support and quote it.

A mailbox in the account menu reads Disabled, so it cannot be opened or Not reachable right now

The first is turned off, as above. We cannot reach the second at the moment. Neither opens until that changes (What each mailbox is).

Claim your @coritan.gg address or No mailbox in your account yet

Your Coritan account has no mailbox yet. Pick a name to get your coritan.gg mailbox (Get a coritan.gg mailbox). To read a mailbox you manage, such as one on Mail Hosting, select Add a mailbox and enter its address and password (Add a mailbox to your account).

mail.coritan.com or webmail.coritan.com opens www.coritan.com/webmail

Webmail lives at www.coritan.com/webmail, and both addresses send you there, to the same page the link named. Update your bookmarks to www.coritan.com/webmail.

That address and password do not match. Check both and try again.

Enter the whole address, such as alex@example.com, and check the password. We give the same answer for a mailbox that is turned off. For your coritan.gg mailbox, the password is your Coritan account password until you give the mailbox one of its own.

A message that starts Too many attempts to sign in.

After 10 failed attempts at one address within 15 minutes, or 20 from one IP address within 5 minutes (an IPv6 address counts as its /64 network), we refuse sign-ins for a while. The message says when you can try again.

Sign in to webmail lists the other messages, and what to do when you have forgotten the password.

Contact support and include:

• The Service ID from the service's Billing tab, or the address of the mailbox involved.
• The domain, and the sender and the recipient of a message that went wrong.
• The whole message or SMTP reply, exactly as it appeared, and when it happened.
• For a message sent through the send API, the message_id from its answer.

Never send a password, an app password or an API key, to us or to anyone else.