Types of Email Delivery Issues
Delivery issues with emails usually fall into one of two categories:
🔴 Emails aren't arriving at all (rejected, or landing in spam). This means your sender's domain has a strict DMARC policy, and Certifier is missing the DNS records needed to send on your behalf.
🔵 Delivery is inconsistent (most emails arrive, but some may be marked as spam). In this case, your domain does not strictly require additional DNS records, but adding them is recommended.
Both cases share the same cause: your DNS settings are missing records that authorize Certifier to send email on your domain's behalf.
Why the Issue Happens
Every domain can set a DMARC policy that tells email providers how to handle messages claiming to come from that domain.
📃 DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication standard that helps prevent spam, spoofing, and phishing.
Depending on how the DMARC policy is configured, it either passes emails through, flags them as suspicious, or rejects them outright — which is why some senders need extra DNS records to be trusted.
A strict DMARC policy requires exact alignment between the domain and the servers sending email on its behalf. That is why emails are rejected or marked as spam when the required DNS records are missing.
💡A policy that is not strict does not require this alignment, but adding the recommended records still improves email deliverability.
Identifying the Affected Sender
If there's an issue with your email sender, Certifier will let you know at several points: as a banner across the app (if it's your workspace's default sender), during the credential issuing flow (if it's credential template's sender), and on the sender's own settings page.
For example, during the issuing flow, an alert in the top bar will let you know about email sender issues.
→ Click the “Set up DNS records” button here to go to the required settings:
You’ll also notice an issue indication in the Email section, specifically the “DNS setup required” or the "DNS setup recommended" tag next to the sender’s email address:
✍️ You can also check any sender's status in Settings → Email Settings → Sender Details:
For each sender, the DNS Status column shows one of three values:
🔴 Setup required — the sender's domain has a strict DMARC policy, and DNS records must be added to avoid emails being rejected or marked as spam.
🔵 Setup recommended — DNS records are not required, but adding them is recommended to improve email deliverability.
🟢 Configured — the required DNS records are already in place.
How to Resolve the Issue
Open the affected sender from the Sender Details list in Settings:
or click Set Up DNS Records button from any alert you see in the app:
2. Any of these actions opens the sender details settings page;
depending on the type of the issue, you’ll see either a red or blue alert, that includes a “Set Up DNS Records” button:
3. Clicking the “Set Up DNS Records” button opens the Set up DNS records window, listing the DNS records (TXT and MX) required for your mail-certifier subdomain:
🔎 Here’s an example of what the records might look like:
MX Record
Host:
mail-certifier.yourcompany.comType: MX
Priority: 10
Value:
feedback-smtp.eu-west-1.amazonses.com
TXT Record (SPF)
Host:
mail-certifier.yourcompany.comType: TXT
Value:
"v=spf1 include:amazonses.com ~all"
4. Copy these values and add them to your domain's DNS zone through your DNS provider:
💡 These records will not affect your default email sending. They only apply to the mail-certifier subdomain used by Certifier.
5. Return to Certifier and click Check DNS Records:
⏳ DNS changes can take up to 72 hours to propagate.
✅ Once Certifier detects the updated records, the sender's status changes to Configured, and all related alerts clear automatically.
Additional Troubleshooting
❗️The alert doesn't go away
If you’ve added the records, waited 72 hours, and still see the warning:
Double-check your DNS entries for typos or formatting issues.
Then, contact our support team with a screenshot of your current DNS records so we can verify and troubleshoot the setup.
❗️No alert in the app, but emails still land in spam
In some cases, you may not see any alert in the Certifier app, but your credential emails are still landing in spam or being marked as unverified by recipients’ email providers. If that’s the case, you can manually add the required records to your DNS zone to improve deliverability:
MX Record
Host:
mail-certifier.yourcompany.comType: MX
Priority: 10
Value:
feedback-smtp.eu-west-1.amazonses.com
TXT Record (SPF)
Host:
mail-certifier.yourcompany.comType: TXT
Value:
"v=spf1 include:amazonses.com ~all"
After adding the records, please contact our support team to manually verify the configuration.
❗️DNS records are set up, but delivery issues continue
If your credential emails are still not delivered correctly after setting up DNS records, consider the pattern:
Trouble delivering to one specific domain?
The issue may be on the recipient's side. Ask them to whitelist your domain.Trouble delivering to multiple domains?
Reach out to us again — there may be more we can help with.
Need more help?
If you still have some questions, do not hesitate to contact us via the chat icon or email us directly: [email protected]