Reference › Diagnosis taxonomy
Diagnosis taxonomy
73 codes. Each one is a stable public contract: switching on a code is supported, and we treat changing or removing one as a breaking change.
Every code is either produced by a fixture in our test harness or carries a written reason why it cannot be. This page is generated from the same two tables the test suite reads, so it cannot describe a code that does not exist or omit one that does.
SPF
Which hosts may send as a domain, and whether the record stays inside the ten DNS lookups receivers allow.
SPF_ALL_MISSINGThis domain's SPF record has no all mechanism, so it neither authorises nor rejects senders it does not list.warningSPF_ALL_NEUTRALThis domain's SPF record ends in ?all, which tells receivers nothing about senders it does not list.warningSPF_ALL_PASSThis domain's SPF record authorises every host on the internet to send as it, which is worse than publishing no record at all.errorSPF_INCLUDE_LOOPThis domain's SPF record includes a chain that loops back on itself, so it can never finish evaluating.errorSPF_INCLUDE_UNRESOLVABLEThis domain's SPF record points at another domain that publishes no SPF record, which makes the whole evaluation a permanent error.errorSPF_IP_AUTHORIZEDThis domain's SPF record authorises the sending address that was checked.infoSPF_IP_NEUTRALThis domain's SPF record says nothing either way about the sending address that was checked, which receivers treat much like no record at all.warningSPF_IP_NOT_AUTHORIZEDThis domain's SPF record rejects the sending address that was checked, so receivers that honour it will refuse those messages.errorSPF_IP_SOFTFAILThis domain's SPF record marks the sending address that was checked as probably unauthorised; receivers usually accept and flag rather than reject.warningSPF_IP_UNDETERMINEDWhether this domain's SPF record authorises the sending address depends on something that is not in DNS, so it cannot be decided from the records alone.warningSPF_LOOKUP_LIMIT_EXCEEDEDChecking this domain's SPF record needs more than the ten DNS lookups receivers allow, so SPF fails for every message.errorSPF_LOOKUP_LIMIT_NEARThis domain's SPF record is close to the ten-lookup limit, so adding one more sending service is likely to break it.warningSPF_MACRO_NOT_EVALUATEDPart of this domain's SPF record changes for every connection, so it cannot be checked from the published records alone.infoSPF_MULTIPLE_RECORDSThis domain publishes more than one SPF record, which authorises nothing at all; the two must be merged into one.errorSPF_MX_LIMIT_EXCEEDEDAn mx mechanism in this domain's SPF record expands to more names than receivers will follow.errorSPF_PTR_MECHANISMThis domain's SPF record uses the ptr mechanism, which is slow, unreliable, and ignored by some receivers.warningSPF_RECORD_MALFORMEDThis domain's SPF record has a syntax error, so receivers reject it outright rather than reading past the mistake.errorSPF_RECORD_MISSINGThis domain publishes no SPF record, so receivers have nothing to check a sending host against.errorSPF_REDIRECT_IGNOREDThis domain's SPF record has both an all mechanism and a redirect, and the redirect is never reached.warningSPF_SOURCE_NOT_AUTHORIZEDThis domain's SPF record does not authorise the sending service being set up, so its messages will fail SPF.errorSPF_TEMPORARY_FAILUREA DNS lookup needed to check this domain's SPF record did not answer, so receivers will defer messages rather than reject them.warningSPF_TERMS_AFTER_ALLThis domain's SPF record lists mechanisms after the all mechanism, where they have no effect.warningSPF_VOID_LOOKUPPart of this domain's SPF record points at a name that does not exist, so it authorises nothing while still counting toward the ten-lookup limit.warningSPF_VOID_LOOKUP_LIMIT_EXCEEDEDMore than two parts of this domain's SPF record point at names that do not exist, which receivers treat as a permanent error.error
DKIM
Whether the signing keys are published, parseable, and strong enough.
DKIM_KEY_MISMATCHA valid DKIM key is published here, but it is not the one we issued. It may be left over from another provider.errorDKIM_KEY_REVOKEDThis DKIM key has been revoked by publishing an empty key. Signatures using this selector will fail.errorDKIM_KEY_TOO_SHORTThis DKIM key is shorter than 1024 bits. Some receivers already refuse keys this small.warningDKIM_KEY_UNPARSEABLEThe public key in this record cannot be read. It was most likely altered when it was pasted in.errorDKIM_RECORD_MALFORMEDA record exists at this selector but it is not a valid DKIM key record, so receivers will ignore it.errorDKIM_RECORD_MISSINGNo DKIM record was found at this selector, so messages signed with it cannot be verified.errorDKIM_TESTING_MODEThis DKIM record is in testing mode, so receivers are told to ignore signature failures. Remove t=y once you are ready.warning
DMARC
What receivers should do with a message that fails, and whether the reports go anywhere.
DMARC_EXTERNAL_REPORT_UNAUTHORIZEDReports are addressed to another domain that has not authorised receiving them, so they are silently discarded.errorDMARC_MULTIPLE_RECORDSMore than one DMARC record is published here. Receivers treat that as no policy at all, so remove the extras.errorDMARC_POLICY_INHERITEDThis subdomain has no DMARC record of its own and inherits the policy published at the organizational domain.infoDMARC_POLICY_NONEThe policy is p=none, so failing messages are still delivered. This is a monitoring setting, not protection.warningDMARC_POLICY_PARTIALThe policy applies to only a percentage of messages, so most failures are still delivered.warningDMARC_RECORD_MALFORMEDA DMARC record exists but cannot be read, so receivers will behave as though there is no policy.errorDMARC_RECORD_MISSINGNo DMARC policy was found for this domain, so receivers have no instructions when a message fails authentication.errorDMARC_REPORT_URI_INVALIDA report address is not a usable URI, so reports for it will not be sent.warning
Mail delivery
Where mail for the domain goes, and whether it can arrive at all.
MX_IMPLICIT_AThis domain has no MX records, so mail is delivered to whatever runs at its address — usually the web server, and usually by accident.infoMX_MAIL_NOT_ACCEPTEDMail sent to this domain cannot be delivered anywhere.errorMX_NULLThis domain declares that it accepts no mail, which is the correct configuration for a domain that only sends.infoMX_NULL_WITH_OTHER_RECORDSThis domain publishes both a null MX and real mail exchanges, so whether a message is delivered depends on whose mail server is trying.errorMX_RECORDS_MISSINGThis domain publishes no MX records, so senders fall back to its address record.warningMX_TARGET_IS_CNAMEOne of this domain's mail exchanges is an alias rather than a host; most senders follow it and some refuse, which looks like an intermittent fault.warningMX_TARGET_IS_IP_LITERALOne of this domain's MX records holds an IP address, which is looked up as a name and resolves to nothing.errorMX_TARGET_UNRESOLVABLEOne of this domain's mail exchanges has no address, so senders have nowhere to connect.error
Nameservers
Whether every nameserver answers, agrees, and serves the zone it was delegated.
NS_ALL_UNREACHABLENone of this domain's nameservers answered, so nothing under this name resolves for anyone.errorNS_DELEGATION_LAMEA nameserver listed for this domain does not answer for it, so some lookups will fail unpredictably.errorNS_PARENT_CHILD_MISMATCHThe nameservers this domain is delegated to are not the same set the zone itself publishes.warningNS_RECORDS_MISSINGThis domain has no nameservers, so nothing under the name resolves.errorNS_SERIAL_MISMATCHThis domain's nameservers hold different versions of the zone, so which answer a customer gets depends on which server they reach.warningNS_SINGLE_NAMESERVERThis domain has only one nameserver, so it is one maintenance window away from disappearing.warningNS_UNREACHABLEOne of this domain's nameservers did not answer; the domain still resolves through the others, which is what makes it easy to miss.warning
Certificates
Which certificate authorities may issue for the name.
CAA_CRITICAL_UNKNOWN_PROPERTYThis domain publishes a CAA property marked critical that authorities do not understand, which blocks all issuance.errorCAA_ISSUANCE_DENIEDThis domain's CAA policy forbids every certificate authority from issuing.errorCAA_ISSUER_NOT_AUTHORIZEDThe certificate authority we use is not listed in this domain's CAA policy, so it cannot issue a certificate.errorCAA_POLICY_FROM_ANCESTORThe CAA policy for this name is published on a parent domain, so changing it may not be within your control.infoCAA_UNRESTRICTEDNo CAA policy applies to this name, so any certificate authority may issue for it.infoCAA_WILDCARD_DENIEDThis domain's CAA policy forbids wildcard certificates, even though ordinary certificates are allowed.error
Resolution
Faults in how the answer arrived rather than in what it said — truncation, negative caching, DNSSEC state.
ANSWER_DIVERGES_BY_VANTAGE_POINTDifferent parts of the internet see different answers for this name, so verification results may be inconsistent.warningDNSSEC_BOGUSDNSSEC signatures for this domain fail validation, so validating resolvers cannot see any of its records.errorDNSSEC_INSECURE_ISLANDThis delegation is unsigned beneath a signed parent, so DNSSEC protection stops here.warningMULTIPLE_DKIM_RECORDSMore than one record exists at this name. Remove the extras so only the correct one remains.errorNEGATIVE_CACHE_LIKELYThis name does not exist yet and the absence may be cached for a while. Wait before re-checking.warningNODATA_NOT_NXDOMAINThe name exists but has no record of the type we need. Something else is configured at this name.warningRRSET_TTL_MISMATCHRecords that belong together carry different lifetimes, so some will disappear from resolvers before the others.warningTCP_SILENTLY_BLOCKEDLarge answers for this domain never arrive, which usually means something is blocking DNS over TCP.errorTRUNCATED_FELL_BACK_TO_TCPThe record is too large for a single UDP response, so it was retrieved over TCP. This is normal for 2048-bit keys.infoTXT_VALUE_SPLIT_MANGLEDThe record was split into chunks and rejoined incorrectly, corrupting the value.errorWILDCARD_FALSE_POSITIVEA wildcard record is answering for this name, so the specific record was never actually added.error
Provider behaviour
Things a DNS provider did to the record after it was pasted in. Each one turns a support ticket into a sentence.