Who has to fix it: me, the sending service or my email provider?

Usually you do, in one of two places: your domain's DNS, or the settings of the service that sends the mail. The sending service fixes what only it controls, such as whether it can sign with your domain and the reputation of its servers. Your email provider, the company that runs your mailboxes, fixes its own servers and any forwarding it runs for you. A recipient can move a message out of spam, but cannot undo a rejection. The steps below find your case from three things you can see: the bounce, the message's header and your DMARC reports.

1. Whose mail is it?

You sent it from an address at your own domain. Go to step 2.
A service sent it from its own address, such as an invoice that comes from the invoicing service's domain with your name on it. That domain, its records and its reputation belong to the service. Who fixes it: the sending service. If the service can send from your domain instead, the mail becomes yours to set up, and step 2 applies.
You sent it from an address at someone else's domain, such as a gmail.com address sent through your internet operator's outgoing server. Only the owner of a domain decides which servers may send as it. Google's rules for every sender say: "Don't impersonate Gmail From: headers." Who fixes it: you. Send mail from a Gmail address through Gmail's own server. Your operator cannot allow its server to send as gmail.com.
Someone else sent it to you, and it bounced or went to spam on the way. Go to step 7.

2. Did it bounce, or land in spam?

It came back with an error message. That is a bounce. Go to step 3.
It arrived, but in the recipient's spam folder. Go to step 4.
Nobody can find it, and no bounce came back. Ask the recipient to look in their spam folder. If it is there, go to step 4.

3. What does the bounce say?

A bounce quotes the receiving server's reply: a code and a sentence. Gmail publishes its own codes, and these five show the main cases:

550 5.7.26 (what it means) with Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. Gmail goes on: Contact the administrator of domain-name domain if this was legitimate email. The mail failed DMARC for your domain. Go to step 4.
421 4.7.32 (what it means): the domain in the From address is not aligned with the domain that SPF or DKIM passed for. Gmail limits how much of this mail it accepts. Go to step 4.
550 5.7.1 with This message is likely unsolicited email. Gmail blocked it as probable spam, and the reply says nothing about authentication. Read Why does mail go to spam when SPF, DKIM and DMARC pass?
550 5.1.1 with The email account that you tried to reach does not exist. Who fixes it: you. Check the address for typos.
552 5.2.2 with The recipient's inbox is out of storage space and inactive. Who fixes it: the recipient.

Outlook.com's code 5.7.515 is also a refusal for failed authentication (what it means). What does my bounce message mean? covers the other codes. What Google, Yahoo and Microsoft ask of senders quotes its full text. Go to step 4.

4. Does it pass DMARC for your domain?

Send a message to a Gmail address of your own, open it, and choose More, then Show original. In the header, the line that starts with Authentication-Results holds dmarc=pass or dmarc=fail, and the domain the result is for. Your DMARC reports show the same result for all mail sent as your domain, service by service. Make sure the pass is for your domain explains each part of the line.

It passes, and the mail still lands in spam. The cause is outside DMARC: the spam rate, reputation, content or forwarding. Who fixes it: you, for what you send and to whom, and the sending service, for the reputation of its servers. Why does mail go to spam when SPF, DKIM and DMARC pass? goes through each.
It fails, or there is no DMARC result. Go to step 5.

5. Which service sent it?

In the same line, smtp.mailfrom names the domain SPF checked, and header.d or header.i the domain of the DKIM signature. When either one is a service's domain and not yours, that service sent the mail.

Your own mailbox: the mail you write in Microsoft 365, Google Workspace or your web host's webmail. Your email provider gives you the SPF and DKIM records, and they go into your domain's DNS. Who fixes it: you, or whoever changes your DNS (step 6). If the provider's DKIM setting is missing or does not turn on, its support fixes that. The guides for Google Workspace and Microsoft 365 have the steps.
Another service: a newsletter tool, a CRM, a webshop, a help desk or an invoicing service. It has to sign your mail with your domain, which is called custom DKIM. DKIM in your own mailbox does not cover it. Who fixes it: you, in the service's settings and in your DNS. If the service cannot sign with your domain, ask its support for it. Set up DKIM for a sending service has the steps.
Your website: a contact form or a webshop that sends from its web server. That mail fails DMARC unless your SPF record lists the server or the server signs with your domain. Who fixes it: whoever built or hosts the site, by sending the mail through your mailbox or a sending service.
A server nobody recognises: someone may be sending as you. Nothing in your setup fixes their mail. A stricter DMARC policy asks mailbox providers to refuse it. Find out who an unknown source is shows what to check.

6. Who changes your DNS?

The records go into your domain's DNS, at the company that runs it. That is usually your web host or email provider, or the company you bought the domain from. If you can sign in there, you make the change. If not, the agency that built your website or your IT contact does, and you send them the name and value of each record. How it works has a message you can forward as it is, with example records. Your domain's page in Mailmoni gives the records for your own domain.

7. Mail sent to you

When mail from someone else's domain bounces or lands in spam on its way to you, the setup of that domain decides. Gmail's bounce says so itself: contact the administrator of the sending domain. Who fixes it: the sender. Forward them the bounce, or this page.

The exception is mail that fails only because of forwarding on your side, such as a rule that sends your work mail on to another mailbox. Forwarding breaks SPF, and changes made to the message on the way break DKIM. Who fixes it: whoever runs the forwarding, your IT contact or your email provider. Google's advice to forwarders is to change the envelope sender to the forwarding domain, and to leave the parts DKIM protects unchanged. When the forwarding address is yours has more.

What the recipient can do

A recipient cannot undo a rejection, because the message never reached their mailbox. Google does not accept allowlist requests from email providers either. A message in the spam folder is different. In Gmail, the recipient chooses More, then Spam, ticks the message and chooses Not spam. Google says future mail from that sender then stays out of Spam. That fixes one mailbox, not the cause.

Find the change in Mailmoni

Fix a source that fails DMARC shows where Mailmoni names the change for each source, and whether it happens in the sending service or in your DNS.