--- title: "Troubleshoot MAIL issues" slug: "sens-troubleshoot-mail" updated: 2026-10-08T06:50:17Z published: 2026-10-08T06:50:17Z canonical: "guide.ncloud-docs.com/sens-troubleshoot-mail" --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshoot MAIL issues Available in Classic and VPC You might run into the following problems when using MAIL. Find out causes and possible solutions. ## Mail delivery failure to Gmail recipients Sending mail to Gmail recipients fails. #### Cause Due to a Gmail policy change effective after 18:00 on January 31, 2024, SPF, DKIM, and DMARC authentication must all be completed for the sending domain to send mail to Gmail addresses. If the 3 authentication steps are not completed, NAVER Cloud Platform treats the delivery as failed. - See [Notice on changes to the Gmail delivery policy due to changes in Gmail sender guidelines](https://www.ncloud.com/support/notice/all/1667). #### Solution Complete SPF, DKIM, and DMARC authentication for the sending domain, and set SPF and DKIM to the in-use status. For instructions on applying authentication, see [Domain Management > Register domain](/docs/en/cloudoutboundmailer-use-domain#%EB%8F%84%EB%A9%94%EC%9D%B8%EB%93%B1%EB%A1%9D). ## Unable to view mail delivery logs There are no logs for the mail I sent. #### Cause Mail delivery history is retained for up to 2 months. Logs cannot be viewed if more than 2 months have passed since the mail was sent. #### Solution Check whether the mail was sent within the last 2 months. Once the log retention period has passed, logs are automatically deleted and cannot be recovered. ## "NONEXISTENT_DOMAIN_ADDRESS" delivery result code and "Recipient domain does not exist" delivery result message When I send mail, the delivery result code is "NONEXISTENT_DOMAIN_ADDRESS", and the delivery result message is "Recipient domain does not exist". #### Cause - The MX record of the recipient domain cannot be found, or there is no mail server available for connection. - The MX record of the recipient domain exists, but all connection tests to the server failed. #### Solution This issue is caused by the DNS settings of the recipient domain or the status of the recipient server. Because it is difficult for NAVER Cloud Platform to identify the exact cause, check the details with the recipient. ## "Connection reset" delivery result message When I send mail, the delivery result message is "Connection reset". #### Cause This issue occurs when the recipient service closes the connection. #### Solution As described in the cause, it is difficult for NAVER Cloud Platform to identify the exact cause, so check the details with the recipient. ## Bulk mail delivery failure Many messages fail when sending bulk mail. #### Cause Delivery can fail due to connection termination, timeouts, connection resets, and other issues on the recipient mail server. Result messages such as "Connection closed by remote host" and "Read timed out" are errors that occur depending on the recipient environment. #### Solution - If you need to check individual failures, send `mail id` or `request id` to [Customer Support](https://www.ncloud.com/support/question/service). - For failures caused by the recipient, such as `Connection closed by remote host`, `Read timed out`, and `Connection reset`, it is difficult for NAVER Cloud Platform to identify the exact cause, so check the details with the recipient. ## Unable to view or remove send block list entries in bulk I want to view or remove all addresses registered in the Send block list at once. #### Cause To protect personal information and ensure service stability, viewing or unblocking email addresses registered in the send block list in bulk is not supported. #### Solution In the **Send block list** menu, enter individual email addresses directly to check whether they are blocked, and unblock them directly if necessary. Unblocking can be performed only in the console and is not supported by the API. ## Delivery failed but received status displayed as Y The mail delivery result is failed, but the received status is displayed as Y. #### Cause If the recipient server receives the mail but does not return a response, successful receipt cannot be confirmed, so the delivery result is processed as failed. However, if the recipient loads an image (URL) included in the mail body, the received status is displayed as Y. #### Solution As described in the cause, the received status Y is based on whether the mail was opened and may be unrelated to whether delivery succeeded. This is normal behavior that depends on how the recipient responds. ## Received status not updated I received the mail, but the received status is not updated. #### Cause Whether mail has been received is determined by whether the image (URL) embedded in the body is loaded when the recipient opens the mail. The received status is not updated in the following cases. - When the recipient's mail service blocks image requests - When image URL requests are blocked by the recipient's network environment or security policy - When the recipient received the mail but has not read it #### Solution The received status is displayed as Y only when the recipient actually opens the mail and loads the images. This may vary depending on the recipient's environment (security policies, mail client settings, and so on). ## Mail delivery failure through API I tried to send mail through the MAIL API, but the "IP not allowed for authentication." error occurred. #### Cause The MAIL service does not separately block the IP addresses of delivery requests. However, when a request is made with a sub account, an authentication error occurs if the request IP is not registered in the sub account's accessible sources (IP allowlist). #### Solution If you receive the "IP not allowed for authentication." response when calling the API with a sub account, check the accessible sources of the sub account and add the IP to the allowlist. For more information about sub account access permissions, see [Create and manage sub accounts](/docs/en/subaccount-use). ## Delivery delay when sending bulk mail I sent bulk mail, but it takes a long time to be received. #### Cause - When bulk mail is sent, the system adjusts the sending rate and processes messages sequentially, so delivery may be delayed. - Additional delays may occur due to the processing speed of the recipient mail server or hourly receiving limits. - If there is a receiving limit, delivery is retried, which can take up to 1 day. #### Solution - Delivery delays are within the scope of normal system operation. Check the delivery status in the **Simple & Easy Notification Service > MAIL > Mailing List** menu of the NAVER Cloud Platform console. - If delivery delays persist, adjust the sending volume and check the recipient's policies. ## Delivery failure displayed The mail delivery result is displayed as "Delivery failed". #### Cause If an error response is received from the recipient mail server, the delivery is processed as failed based on that response. #### Solution To check the reason for a delivery failure: 1. In the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Application Services** > **Simple & Easy Notification Service** > **MAIL** > **Mailing List**. 2. Click **Number of recipients** in the list. 3. In the list by recipient, click a failed mail. 4. On the mail details interface, click **Failure reason**. - This message shows the recipient server's response as is, so it may be difficult to interpret. If you need a more detailed explanation, send the failure message to [Customer Support](https://www.ncloud.com/support/question/service). ## Troubleshoot DKIM authentication issues Learn how to diagnose and resolve DKIM authentication issues with MAIL. ### DKIM authentication failure checklist If DKIM authentication fails, check the following items in order: **Step 1: Verify prerequisites.** - Is domain authentication complete? - Is the SPF record resolved correctly? **Step 2: Verify DKIM record registration.** - Is the TXT record registered on the correct host? (`{selector}._domainkey.{domain}`) - Is the DKIM signature value split and registered in a multi-line format? **Step 3: Verify the selector.** - Are you using the correct selector for your environment and region? **Step 4: Verify record lookup.** - Is the record resolved using nslookup? - Is the lookup result in multi-line format? (Verify that it is not registered as separate records.) **Step 5: Verify console settings.** - Is DKIM authentication complete? - Did you click **[Enable]** for activation? ### DKIM authentication failure - DKIM authentication is not working. - Email delivery fails due to DKIM authentication failure. #### Cause - The selector is incorrectly configured. - The DKIM signature value is not registered correctly. - The domain or SPF authentication record is missing. #### Solution Check the following items in order: **1. Verify domain and SPF authentication.** Records for domain and SPF authentication must be registered as a prerequisite for DKIM authentication. See [View domain](/docs/en/cloudoutboundmailer-use-domain#%EB%8F%84%EB%A9%94%EC%9D%B8%ED%99%95%EC%9D%B8) to verify that the domain authentication token value and SPF record are resolved. **2. Verify TXT record registration.** The DKIM signature value must be registered as a TXT record at the `{selector}._domainkey` host of the registered domain. For example, if the domain is `example.com` and the selector is `ncpcompubkr`: - Host: `ncpcompubkr._domainkey.example.com` Caution - The DKIM signature value consists of 392 characters. - As DNS TXT records have a 255-character limit per string, the syntax must be split into multiple strings enclosed in double quotes for registration. - For Global DNS, TXT records exceeding 255 characters are automatically wrapped, allowing you to register the signature value as is. For more information, see Global DNS. - If your DNS service provider does not support registering TXT records exceeding 255 characters, contact that provider and request support. - MAIL supports only 2,048-bit DKIM signatures for enhanced security. Use a 2,048-bit DKIM key. **3. Verify the selector.** Selectors vary depending on the environment and region. For instructions on verifying the selector, see [DKIM authentication](/docs/en/cloudoutboundmailer-use-domain#DKIM%EC%9D%B8%EC%A6%9D). | Environment | Region | Selector | | --- | --- | --- | | Private | Korea (KR) | `ncpcompubkr` | | Private | Japan (JP) | `ncpcompubjpn` | | Financial | Korea (KR) | `ncpcomfin` | | Public | Korea (KR) | `ncpcomgov` | **4. Verify record lookup.** Enter the following command to confirm that the DKIM signature value is registered correctly: ``` # Using nslookup $ nslookup -q=txt ncpcompubkr._domainkey.example.com # Using dig $ dig txt ncpcompubkr._domainkey.example.com ``` **Correct registration (multi-line format)** ``` ncpcompubkr._domainkey.example.com text = "v=DKIM1;k=rsa;p=MIIB..." "..." ``` The result must be returned as a **single record** in multi-line format consisting of 2 string blocks. **Incorrect registration (separate records)** ``` ncpcompubkr._domainkey.example.com text = "v=DKIM1;k=rsa;p=MIIB..." ncpcompubkr._domainkey.example.com text = "..." ``` If registered as **separate records** as shown above, DKIM authentication may fail or results may alternate between success and failure. Re-register in the multi-line format. For instructions on splitting TXT record registration, contact your domain service provider. **5. Verify DKIM authentication settings.** Check the DKIM authentication status in the console and verify that it is enabled. After authentication is complete, click **[Enable]** to activate it so that DKIM authentication functions properly when sending emails. For more information, see [DKIM authentication](/docs/en/cloudoutboundmailer-use-domain#DKIM%EC%9D%B8%EC%A6%9D). Caution - After authentication is complete, clicking **[Enable]** for activation changes the button to **[Disable]** and displays the "Enabled" status. - Modifying or deleting an authenticated record may cause authentication to fail when sending emails. Therefore, keep the records registered for authentication unchanged. ### DKIM authentication failure despite signature value retrieval The DKIM signature value is successfully retrieved, but DKIM authentication fails. #### Cause - Records for domain or SPF authentication are either incorrectly registered or missing. - DNS record changes may be in the process of propagating. #### Solution To perform DKIM authentication, all records for the domain and SPF authentication must be registered. See [View domain](/docs/en/cloudoutboundmailer-use-domain#%EB%8F%84%EB%A9%94%EC%9D%B8%ED%99%95%EC%9D%B8) to verify that the domain authentication token value and SPF record are resolved. **Pending DNS record propagation** If records are registered correctly but authentication fails, it may take time for DNS record changes to propagate. Retry authentication after waiting for a period of time (typically several minutes to a maximum of 24 hours). Caution - Propagation time differences by DNS server: Propagation time may vary depending on the DNS server being queried. Authentication may fail if records have not yet been propagated to the internal authentication server, even if a manual query returns the correct record. - Time to Live (TTL) cache: If a long TTL was set during the previous record registration, the existing record may be cached and returned during a query. In this case, the new record will be successfully retrieved after the TTL expires. - Record update: Forced record updates are not supported internally. We recommend setting an appropriate TTL value (e.g., 300 to 3,600 seconds) when registering records. ### Alternating success and failure during email delivery - DKIM authentication complete. - Delivery results alternate between success and failure during email delivery. #### Cause - If the DKIM signature value is registered as multiple separate records, delivery success and failure may alternate. - As the order of DNS record lookup results is not guaranteed, DKIM authentication may succeed or fail based on the order of return. #### Solution See [View domain](/docs/en/cloudoutboundmailer-use-domain#%EB%8F%84%EB%A9%94%EC%9D%B8%ED%99%95%EC%9D%B8) to check if the DKIM signature value is registered correctly. **Record lookup and verification** ``` $ nslookup -q=txt ncpcompubkr._domainkey.example.com ``` **Correct format (multi-line in a single record)** ``` ncpcompubkr._domainkey.example.com text = "v=DKIM1;k=rsa;p=MIIB..." "..." ``` **Incorrect format (split into separate records)** ``` ncpcompubkr._domainkey.example.com text = "v=DKIM1;k=rsa;p=MIIB..." ncpcompubkr._domainkey.example.com text = "..." ``` If registered as separate records, the order is not guaranteed during DNS lookup, resulting in alternating delivery success and failure. The record must be re-registered as a single record in multi-line format. For instructions on splitting TXT record registration, contact your domain service provider. ## SPF authentication failure SPF authentication fails. #### Cause SPF information is incorrectly registered in the domain's TXT record, or there is a formatting issue. #### Solution To check the TXT record for the registered domain: 1. Enter the following command to look up the SPF record registered for the domain: ``` nslookup -q=txt example.com ``` 2. Check if the SPF record is retrieved as a single string block, as shown below. ``` example.com text = "v=spf1 include:email.ncloud.com ~all" ``` - The lookup result must show the SPF record registered as a single string enclosed in double quotes. Note If you're still having trouble finding what you need, click on the feedback icon and send us your thoughts and requests. We'll use your feedback to improve this guide.