Mail deliverability and trace: follow the message, not the guess

Begin with public mail DNS

A mail server can accept a message correctly and still have poor delivery because public DNS tells an incomplete story. SHM checks the public MX records for the selected mail domain, verifies that MX targets resolve to publicly routable addresses, and looks for SPF, DKIM, and DMARC evidence.

The account sending IP also receives reverse-DNS context. PTR is shown as a useful external signal, while the main deliverability score uses five explicit checks:

• public MX and a routable mail host;
• SPF and DKIM authentication;
• a published DMARC policy.

Each result stays tied to evidence that the operator can review.

Compare managed records with public DNS

SHM can inspect the mail records known in the managed zone and compare them with what public DNS currently returns. This distinction catches a common failure: the panel contains the right record, but delegation, propagation, or an external DNS provider means the internet sees something else.

For DKIM, the check uses selectors known from the managed mail state and a bounded set of common selectors. A passing result means a checked public selector publishes a DKIM key; it does not promise that every message at every remote provider will reach the inbox.

Follow the message through Exim

The trace view parses Exim delivery events for the account's domains and mailboxes. It groups the acceptance event and recipient results by message ID, then labels the message as accepted, delivered, deferred, failed, or partially delivered. Incoming, outgoing, internal, sender, mailbox, status, and supported time-range filters make a busy log usable.

Recipient details and a bounded raw excerpt remain available, which is where the useful answer often lives: remote rejection text, a deferred route, or the destination that accepted the message.

Keep each trace inside the account

Trace records are included only when the sender, authenticated mailbox, local user, envelope recipient, or delivery recipient belongs to the account. A sender filter is accepted only for a mailbox owned by that account. This prevents a convenient mail report from becoming a cross-customer log search.

The parser also bounds lines, bytes, records, and raw excerpts. Very busy or long-retained logs can report that a scan was truncated, rather than consuming unlimited resources to produce an apparently complete answer.

Understand the available history

The deliverability context summarises the last 24 hours, while the detailed trace supports configured ranges from recent minutes up to seven days. Actual availability depends on Exim log rotation and retention. Older events may no longer be present, and SHM says so directly.

Mail Deliverability and Trace does not replace remote-provider postmaster tools, reputation data, or message headers from a recipient. It does provide the local half of the story: public authentication records, the sending context, and what Exim did with this account's message. Together, those signals provide a practical starting point for a delivery investigation.