What breaks business email.

The shape of the problem

When a website goes down, somebody notices within hours. When email stops being delivered, your outbox says sent, no error appears anywhere, and the effect is simply that people stop replying. Quotes go unanswered. Invoices go unpaid. It reads as a slow patch rather than a fault.

The reason is that most modern mail rejection is silent by design. The receiving server accepts your message and then files it in a spam folder or discards it, precisely so that senders cannot use bounce messages to work out what gets through.

The four things that actually break

MX records. These decide where your incoming mail is delivered. Remove or misconfigure them and mail addressed to you goes nowhere. Usually caused by a DNS change made for an unrelated reason.

SPF. A list of who may send on your behalf. It has a hard limit on how many lookups it can perform, and adding senders over the years eventually crosses it. Past that point the whole record fails, and it fails silently.

DKIM. A signature proving mail came from you. Providers rotate keys. If the published key in DNS is not updated to match, signatures stop verifying.

DMARC. Instructions for what receiving servers should do when the above fails. The dangerous version is a strict policy combined with a sender that was never properly authorised, such as an invoicing tool or a booking system. Your own mail is then rejected on your own instructions.

Why it goes unnoticed for months

• No error is generated on the sending side
• Some mail still gets through, so it looks intermittent rather than broken
• Internal mail is unaffected, so it works fine when you test it with a colleague
• The change that caused it was usually made for an unrelated reason weeks earlier

How to tell whether it is happening to you

Check the records rather than sending test mail to yourself, because self-addressed tests pass in almost all of these cases. The check needs to look at whether authentication actually passes for external recipients, not whether the records exist.

What fixes it, roughly

• Keep the list of authorised senders short, and remove tools you no longer use
• Update DKIM keys in DNS whenever a provider rotates them
• Move a DMARC policy to strict only after confirming every legitimate sender passes
• Note what your mail records looked like before any DNS change, because that is what you will want an hour later

This belongs to a wider category, examined in the failures that do not produce an error.