Start with the rejection, not a broad DNS change
Save the full bounce or refusal text and note when it occurred, the recipient domain, and the address used as the sender. A temporary delay, an unknown recipient, and an authentication failure point to different next steps. Avoid repeatedly sending the same message while the reason is unclear.
Check the sending identity and the domain configured for the service. SPF identifies permitted sending sources, DKIM lets a receiver verify a message signature, and DMARC tells receivers how to handle authentication results for the visible domain. Each record has a distinct role; changing one does not automatically repair the others.
Verify alignment before retrying
Compare the domain in the sender address with the domains covered by the published authentication records. Confirm that each record is placed at the correct DNS name and that there is not a second conflicting SPF record at that name. If you recently edited DNS, verify the public response rather than relying only on the control panel.
After correcting a specific mismatch, send a small test to an address you can inspect and review the result. If rejection continues, use the new response to narrow the diagnosis. Do not change MX records simply because outgoing mail is refused; MX controls incoming routing and may serve a separate provider.