Troubleshoot MAIL issues

Available in Classic and VPC

You might run into the following problems when using MAIL. Find out causes and possible solutions.

Mail delivery failure to Gmail recipients

Sending mail to Gmail recipients fails.

Cause

Due to a Gmail policy change effective after 18:00 on January 31, 2024, SPF, DKIM, and DMARC authentication must all be completed for the sending domain to send mail to Gmail addresses. If the 3 authentication steps are not completed, NAVER Cloud Platform treats the delivery as failed.

• See Notice on changes to the Gmail delivery policy due to changes in Gmail sender guidelines.

Solution

Complete SPF, DKIM, and DMARC authentication for the sending domain, and set SPF and DKIM to the in-use status. For instructions on applying authentication, see Domain Management > Register domain.

Unable to view mail delivery logs

There are no logs for the mail I sent.

Cause

Mail delivery history is retained for up to 2 months. Logs cannot be viewed if more than 2 months have passed since the mail was sent.

Solution

Check whether the mail was sent within the last 2 months. Once the log retention period has passed, logs are automatically deleted and cannot be recovered.

"NONEXISTENT_DOMAIN_ADDRESS" delivery result code and "Recipient domain does not exist" delivery result message

When I send mail, the delivery result code is "NONEXISTENT_DOMAIN_ADDRESS", and the delivery result message is "Recipient domain does not exist".

Cause

• The MX record of the recipient domain cannot be found, or there is no mail server available for connection.
• The MX record of the recipient domain exists, but all connection tests to the server failed.

Solution

This issue is caused by the DNS settings of the recipient domain or the status of the recipient server. Because it is difficult for NAVER Cloud Platform to identify the exact cause, check the details with the recipient.

"Connection reset" delivery result message

When I send mail, the delivery result message is "Connection reset".

Cause

This issue occurs when the recipient service closes the connection.

Solution

As described in the cause, it is difficult for NAVER Cloud Platform to identify the exact cause, so check the details with the recipient.

Bulk mail delivery failure

Many messages fail when sending bulk mail.

Cause

Delivery can fail due to connection termination, timeouts, connection resets, and other issues on the recipient mail server.
Result messages such as "Connection closed by remote host" and "Read timed out" are errors that occur depending on the recipient environment.

Solution

• If you need to check individual failures, send mail id or request id to Customer Support.
• For failures caused by the recipient, such as Connection closed by remote host, Read timed out, and Connection reset, it is difficult for NAVER Cloud Platform to identify the exact cause, so check the details with the recipient.

Unable to view or remove send block list entries in bulk

I want to view or remove all addresses registered in the Send block list at once.

Cause

To protect personal information and ensure service stability, viewing or unblocking email addresses registered in the send block list in bulk is not supported.

Solution

In the Send block list menu, enter individual email addresses directly to check whether they are blocked, and unblock them directly if necessary. Unblocking can be performed only in the console and is not supported by the API.

Delivery failed but received status displayed as Y

The mail delivery result is failed, but the received status is displayed as Y.

Cause

If the recipient server receives the mail but does not return a response, successful receipt cannot be confirmed, so the delivery result is processed as failed. However, if the recipient loads an image (URL) included in the mail body, the received status is displayed as Y.

Solution

As described in the cause, the received status Y is based on whether the mail was opened and may be unrelated to whether delivery succeeded. This is normal behavior that depends on how the recipient responds.

Received status not updated

I received the mail, but the received status is not updated.

Cause

Whether mail has been received is determined by whether the image (URL) embedded in the body is loaded when the recipient opens the mail. The received status is not updated in the following cases.

• When the recipient's mail service blocks image requests
• When image URL requests are blocked by the recipient's network environment or security policy
• When the recipient received the mail but has not read it

Solution

The received status is displayed as Y only when the recipient actually opens the mail and loads the images. This may vary depending on the recipient's environment (security policies, mail client settings, and so on).

Mail delivery failure through API

I tried to send mail through the MAIL API, but the "IP not allowed for authentication." error occurred.

Cause

The MAIL service does not separately block the IP addresses of delivery requests. However, when a request is made with a sub account, an authentication error occurs if the request IP is not registered in the sub account's accessible sources (IP allowlist).

Solution

If you receive the "IP not allowed for authentication." response when calling the API with a sub account, check the accessible sources of the sub account and add the IP to the allowlist.
For more information about sub account access permissions, see Create and manage sub accounts.

Delivery delay when sending bulk mail

I sent bulk mail, but it takes a long time to be received.

Cause

• When bulk mail is sent, the system adjusts the sending rate and processes messages sequentially, so delivery may be delayed.
• Additional delays may occur due to the processing speed of the recipient mail server or hourly receiving limits.
• If there is a receiving limit, delivery is retried, which can take up to 1 day.

Solution

• Delivery delays are within the scope of normal system operation. Check the delivery status in the Simple & Easy Notification Service > MAIL > Mailing List menu of the NAVER Cloud Platform console.
• If delivery delays persist, adjust the sending volume and check the recipient's policies.

Delivery failure displayed

The mail delivery result is displayed as "Delivery failed".

Cause

If an error response is received from the recipient mail server, the delivery is processed as failed based on that response.

Solution

To check the reason for a delivery failure:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Application Services > Simple & Easy Notification Service > MAIL > Mailing List.
2. Click Number of recipients in the list.
3. In the list by recipient, click a failed mail.
4. On the mail details interface, click Failure reason.
   • This message shows the recipient server's response as is, so it may be difficult to interpret. If you need a more detailed explanation, send the failure message to Customer Support.

Troubleshoot DKIM authentication issues

Learn how to diagnose and resolve DKIM authentication issues with MAIL.

DKIM authentication failure checklist

If DKIM authentication fails, check the following items in order:

Step 1: Verify prerequisites.

• Is domain authentication complete?
• Is the SPF record resolved correctly?

Step 2: Verify DKIM record registration.

• Is the TXT record registered on the correct host? ({selector}._domainkey.{domain})
• Is the DKIM signature value split and registered in a multi-line format?

Step 3: Verify the selector.

• Are you using the correct selector for your environment and region?

Step 4: Verify record lookup.

• Is the record resolved using nslookup?
• Is the lookup result in multi-line format? (Verify that it is not registered as separate records.)

Step 5: Verify console settings.

• Is DKIM authentication complete?
• Did you click [Enable] for activation?

DKIM authentication failure

• DKIM authentication is not working.
• Email delivery fails due to DKIM authentication failure.

Cause

• The selector is incorrectly configured.
• The DKIM signature value is not registered correctly.
• The domain or SPF authentication record is missing.

Solution

Check the following items in order:

1. Verify domain and SPF authentication.

Records for domain and SPF authentication must be registered as a prerequisite for DKIM authentication. See View domain to verify that the domain authentication token value and SPF record are resolved.

2. Verify TXT record registration.

The DKIM signature value must be registered as a TXT record at the {selector}._domainkey host of the registered domain.

For example, if the domain is example.com and the selector is ncpcompubkr:

• Host: ncpcompubkr._domainkey.example.com

3. Verify the selector.

Selectors vary depending on the environment and region. For instructions on verifying the selector, see DKIM authentication.

4. Verify record lookup.

Enter the following command to confirm that the DKIM signature value is registered correctly:

# Using nslookup
$ nslookup -q=txt ncpcompubkr._domainkey.example.com

# Using dig
$ dig txt ncpcompubkr._domainkey.example.com

Correct registration (multi-line format)

ncpcompubkr._domainkey.example.com   text = "v=DKIM1;k=rsa;p=MIIB..." "..."

The result must be returned as a single record in multi-line format consisting of 2 string blocks.

Incorrect registration (separate records)

ncpcompubkr._domainkey.example.com   text = "v=DKIM1;k=rsa;p=MIIB..."
ncpcompubkr._domainkey.example.com   text = "..."

If registered as separate records as shown above, DKIM authentication may fail or results may alternate between success and failure. Re-register in the multi-line format. For instructions on splitting TXT record registration, contact your domain service provider.

5. Verify DKIM authentication settings.

Check the DKIM authentication status in the console and verify that it is enabled. After authentication is complete, click [Enable] to activate it so that DKIM authentication functions properly when sending emails. For more information, see DKIM authentication.

DKIM authentication failure despite signature value retrieval

The DKIM signature value is successfully retrieved, but DKIM authentication fails.

Cause

• Records for domain or SPF authentication are either incorrectly registered or missing.
• DNS record changes may be in the process of propagating.

Solution

To perform DKIM authentication, all records for the domain and SPF authentication must be registered. See View domain to verify that the domain authentication token value and SPF record are resolved.

Pending DNS record propagation
If records are registered correctly but authentication fails, it may take time for DNS record changes to propagate. Retry authentication after waiting for a period of time (typically several minutes to a maximum of 24 hours).

Alternating success and failure during email delivery

• DKIM authentication complete.
• Delivery results alternate between success and failure during email delivery.

Cause

• If the DKIM signature value is registered as multiple separate records, delivery success and failure may alternate.
• As the order of DNS record lookup results is not guaranteed, DKIM authentication may succeed or fail based on the order of return.

Solution

See View domain to check if the DKIM signature value is registered correctly.

Record lookup and verification

$ nslookup -q=txt ncpcompubkr._domainkey.example.com

Correct format (multi-line in a single record)

ncpcompubkr._domainkey.example.com   text = "v=DKIM1;k=rsa;p=MIIB..." "..."

Incorrect format (split into separate records)

ncpcompubkr._domainkey.example.com   text = "v=DKIM1;k=rsa;p=MIIB..."
ncpcompubkr._domainkey.example.com   text = "..."

If registered as separate records, the order is not guaranteed during DNS lookup, resulting in alternating delivery success and failure. The record must be re-registered as a single record in multi-line format. For instructions on splitting TXT record registration, contact your domain service provider.

SPF authentication failure

SPF authentication fails.

Cause

SPF information is incorrectly registered in the domain's TXT record, or there is a formatting issue.

Solution

To check the TXT record for the registered domain:

1. Enter the following command to look up the SPF record registered for the domain:

   nslookup -q=txt example.com
   

2. Check if the SPF record is retrieved as a single string block, as shown below.
   • The lookup result must show the SPF record registered as a single string enclosed in double quotes.

   example.com text = "v=spf1 include:email.ncloud.com ~all"