Start with the symptom, then prove the layer.

Website works, but inbound email stops

Likely layer: missing or incorrect MX after nameserver cutover.

Check: compare public MX answers and priorities with the mail provider’s current setup screen. Confirm cPanel Email Routing if cPanel is involved.

SPF returns PermError

Likely causes: multiple SPF records, invalid syntax, loops, or too many DNS-triggering mechanisms.

Fix: merge to one record, remove retired senders, and simplify provider includes. Do not create a second SPF record as a patch.

DKIM record exists, but mail is unsigned

Likely layer: the provider has not enabled signing, the selector is wrong, or the message uses another sending service.

Check: provider signing status and the message’s DKIM-Signature selector.

SPF passes, but DMARC fails

Likely cause: SPF authenticated a different envelope domain that does not align with the visible From address.

Fix: configure aligned DKIM or an aligned return-path through the sender.

Forwarded mail fails SPF

Forwarding can change the delivering IP while preserving the original envelope identity. Aligned DKIM is more resilient when message content and signatures survive forwarding.

Some networks return SERVFAIL

Likely layer: DNSSEC chain, lame delegation, or inconsistent authorities.

Check: parent DS, child DNSKEY/RRSIG, and answers from every authoritative nameserver before changing ordinary A or MX records.

Old records remain visible

Likely layer: recursive cache or incomplete authority rollout.

Check: query each authority directly, then compare multiple public recursive resolvers. Wait for the previous TTL before assuming a failed update.

WordPress forms reach spam or disappear

Use authenticated SMTP, align the From domain, put the visitor in Reply-To, verify DKIM signing, and inspect the provider or cPanel mail log. A successful form page does not prove mail delivery.