What tools help debug delivery failures?

The right debugging tool depends on what's failing. Authentication problems need different tools than reputation problems. Here's a practical reference by failure type.

Authentication and DNS:

• MXToolbox: SPF lookup, DKIM record check, MX resolution, blacklist scan. Good starting point for most authentication questions.
• Google Admin Toolbox (toolbox.googleapps.com): Check SPF, DKIM, DMARC from Google's perspective. Especially useful for Gmail delivery issues.
• dig / nslookup: command-line DNS queries if you need raw resolution results rather than a web interface.

Reputation and blocklists:

• Google Postmaster Tools: domain reputation, IP reputation, spam rate, and authentication pass rates as seen by Gmail. Free but requires ownership verification.
• Microsoft SNDS (Smart Network Data Services): same for Outlook/Hotmail. Shows complaint rate, spam filter hits, IP activity.
• Spamhaus lookup: check if your IP or domain is on their lists (SBL, XBL, DBL). Used by more mail servers than any other blocklist.

SMTP testing:

• swaks (Swiss Army Knife for SMTP): command-line tool for sending test emails with full control over headers, envelope sender, and TLS. The most flexible SMTP tester available.
• openssl s_client: test TLS connections directly to a mail server. Useful for diagnosing certificate or TLS negotiation failures.
• telnet: basic SMTP conversation testing. Lower-level than swaks but useful for isolating connection issues.

Email header analysis:

• Our Email Header Analyzer: paste a raw email header and see authentication results (SPF, DKIM, DMARC pass/fail), routing, and timing.
• MXToolbox Email Header Analyzer: similar functionality, also free.

If you're not sure where to start: authentication failures and blocklist listings are the two most common causes of delivery problems. Check your SPF/DKIM/DMARC setup first, then run a blocklist check on your sending IP and domain. Those two steps resolve the majority of delivery failures.