Your Open Rates Just Tanked—Now What?
You notice it when a customer asks why they never got your invoice. Then you check the campaign report and see open rates have fallen off a cliff. Emails that always landed in inboxes are now disappearing. Your team’s sending habits haven’t changed, but suddenly you’re invisible to the people who need to see your mail.
Before you panic and blame your email platform, understand this: the most common cause of delivery failure sits at a level most business leaders never see. It’s not your subject line or your domain’s age. It’s a handful of DNS configurations that tell email receivers whether your messages are legitimate. When those settings are wrong, missing, or forgotten, delivery quietly breaks.
The Reason Nobody Sees Coming: DNS Drift
At its core, email delivery depends on a chain of trust. Every time you send a message, the receiving server checks your domain’s DNS records to answer three questions: Are you really who you claim to be? Are you allowed to send that mail? And what should I do if the answer is no?
Most companies set these records once—when they first configure their email service—and never look again. But your sending landscape changes. Marketing tools get added, transaction email services rotate keys, your mail provider migrates infrastructure. Each change introduces drift between what your DNS says and what your real sending behavior looks like. Over weeks or months, that gap widens until enough receivers treat your mail as suspicious. That’s when delivery rates drop.
There are five core points of failure, and almost all of them boil down to three or four DNS-level misconfigurations. The good news: once you know what to look for, you can fix them in an afternoon.
The DNS Misconfigurations That Kill Deliverability
MX Records: Where Is Your Mail Supposed to Go?
The Problem
MX records tell the world which servers handle incoming email for your domain. If they point to a decommissioned provider, a parked domain, or are entirely missing, no one can send mail back to you. That doesn’t directly break outgoing delivery, but it kills the flow of replies, receipts, and back-and-forth that keeps your domains trusted. Receiving servers notice when a domain doesn’t accept mail, and that erodes reputation signals over time.
How to Fix It
Check that your MX records point to your actual mail provider’s servers—like aspmx.l.google.com for Google Workspace or the hostnames your Microsoft 365 admin panel shows you. Avoid extra entries that reference old providers. A clean, single set of MX records tells the world you’re reachable. Learn more about how these records work in our guide to MX Records.
SPF: Who Gets to Send Mail on Your Behalf?
The Problem
An SPF record lists every service authorized to send email as your domain. The most common failure: the record is missing altogether—often because the domain was set up without it. Almost as common: it lists your primary email provider but not the marketing platform, the CRM, or the survey tool you added last quarter. Those unlisted services send mail that fails SPF checks, so it lands in spam or gets silently rejected.
How to Fix It
Audit every service that sends email from your domain—transactional mail, sales outreach, support desk, billing platform—and build a single SPF record that includes all of them. Use include: mechanisms for each service and end with -all (strict) or ~all (softfail). Never publish multiple SPF records; that breaks the check entirely. Get the full picture from our SPF guide.
DKIM: Is Your Email Really From You?
The Problem
DKIM adds a cryptographic signature to your outgoing mail. When the signature is missing—because the sending platform never generated a key, or the DNS record was deleted during a domain migration—receivers see unsigned email. Without that proof, they can’t distinguish your legitimate mail from a spoofed one. Messages start getting flagged, especially by stricter providers like Gmail and Yahoo.
How to Fix It
Ensure every sending service has a unique DKIM key pair. The public key lives in a DNS record like selector._domainkey.yourdomain.com with the v=DKIM1; k=rsa; p=... content. Verify each service’s DNS entry is present and the key hasn’t expired or been truncated. For a deeper dive, read our explanation of DKIM Explained.
DMARC: What Happens When Mail Fails Authentication?
The Problem
DMARC is the policy that tells receivers what to do when SPF or DKIM checks fail. An absent DMARC record means no policy at all, leaving receivers to guess. A misconfigured DMARC with p=reject applied too early can accidentally block legitimate mail from newly integrated services. Both extremes cause delivery problems: one through inaction, the other through overly aggressive enforcement.
How to Fix It
Start with p=none and a reporting address using rua=mailto: to collect forensic data. Monitor the reports for a few weeks to see which services fail authentication. Then gradually move to p=quarantine and eventually p=reject once you’re confident no legitimate mail is being caught. Our DMARC guide walks through the exact syntax and decision tree.
How to Stop Delivery Failure Before It Starts
DNS drift doesn’t announce itself. You only notice when delivery is already broken. A simple monitoring habit catches misconfigurations before they impact recipients.
A tool like TechSpy can scan your domain in seconds and flag every broken record, missing policy, or configuration drift—the same issues that silently tank delivery.
The Bottom Line
When your email delivery rate drops, the answer is rarely your content or your audience. It’s the invisible layer of DNS records that receivers rely on to trust your mail. One missing SPF include, a stale MX pointer, or a DKIM key that vanished during a switch can push your messages into the spam folder without a single warning.
The fix doesn’t require a technical deep dive or an expensive consultant. Audit your records, include every sender, and give receivers a clear policy. Most importantly, don’t wait until a customer tells you they’re not getting your mail. Run a scan. See what’s actually configured. Fix what’s missing. Your delivery rate depends on it.