> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Handle Authentication Issues

> Diagnose common email authentication problems, such as legitimate senders blocked for missing SPF or DKIM.

Most commonly:

* A legitimate email is blocked because the sender does not provide proper authentication
* SPF or DKIM is correct, but the email is not marked as authentic

| Situation                                                        | Explanation                                                                                                                                                                                     | Measures                                                                                                                                                                                                                     |
| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Sender has valid SPF but is not marked authentic**             | Usually, the envelope from domain (used for SPF) differs from the header from domain, which breaks DMARC alignment.                                                                             | Ask the sender to use the same domain for both. If that’s not possible, configure a [Trusted MTA](/latest/trusted-mtas) in xorlab to override authentication.                                                                |
| **Email has a valid DKIM signature but is not marked authentic** | Usually, the DKIM signing domain is different from the header from domain, which breaks DMARC alignment.                                                                                        | Ask the sender to sign with the same domain as the header from. If that’s not possible, use a [Trusted MTA](/latest/trusted-mtas) configuration.                                                                             |
| **SPF/DKIM failed, but the email was not blocked**               | A failing SPF or DKIM alone is not enough to block an email, as this also happens with legitimate mail. However, it is still treated as a negative signal and increases the chance of blocking. | If you want to block all such emails, create a [campaign](/latest/campaigns) based on the `#dkimfail` and `#spffail` tags.                                                                                                   |
| **Email passes SPF/DKIM but is still blocked**                   | Authentication only proves that the email was actually sent from the sender domain, not that the email is safe. Attackers can still send from valid domains.                                    | Create a [campaign](/latest/campaigns), or add the sender to the **Low trusted sender addresses** list ([Trusted Senders and Infrastructure](/latest/trusted-senders-infrastructure)) to make sure the email is not blocked. |