A destination Test fails or backups to it fail. What do I check?

First checks (any destination)

Choose Test on the destination's card and read the message and latency.
Check the server can reach the destination: outbound firewall (CSF, firewalld, the cloud's egress rules), DNS, and the provider's status.
Check the server clock is right (chronyc tracking or timedatectl). Signed requests fail on a skewed clock.
Check the destination is enabled (the Destination enabled tick) and the credentials have not been rotated or expired.
Remember a Test works only on an existing destination: create it first.

Amazon S3, Wasabi, Backblaze B2 and compatible stores

Region and endpoint: the region is required. For a non-AWS store fill in Custom endpoint URL. B2 derives the endpoint from the region if blank.
Keys: the access key needs list, read, write and delete on the bucket.
Object Lock: on an Object Lock bucket, deletes fail. On a versioned bucket, deleted objects stay as versions. Use a bucket with both off.
Path prefix: bw/ and bw are different keys. A prefix typo leaves backups where you did not expect them.
Google Cloud Storage through the S3 type needs the endpoint https://storage.googleapis.com and a lower-case region such as us-central1.

SFTP

Host key changed: if the server's key changed, the connection stops before login and backups fail until an administrator re-pins it. Verify the new key, then re-pin on the destination's card. A Test that finds another key says so.
Connection resets or "banner" errors: BackupWall opens at most 4 SSH logins at once. A server that allows fewer simultaneous connections may reset them. Raise the server's limit.
Authentication: a private key must be Ed25519, ECDSA or RSA; add the Key passphrase if the key is encrypted. Leave Password blank for key authentication.
Remote path: the account needs to be able to create and delete files there. An absolute path stays absolute.

Google Cloud Storage (native type)

It needs the whole service account key JSON. If your Google Cloud organization blocks creating service account keys, use the Amazon S3 type with an HMAC key. See Google Cloud Storage.

Google Drive

The service account must be able to see the folder: share the folder with the service account's email address, or use a Shared Drive it belongs to.
Folder ID is the last part of the folder's web address.
Google's storage-quota errors for service accounts are not handled specially and show up as failed uploads.
Drive is rate-limited to about 2.5 requests per second; large backups are slow, not broken.

OneDrive

Microsoft 365 work or school only.
The Graph application permission Files.ReadWrite.All needs admin consent.
Tenant ID or domain must be your tenant (not common), and you need either OneDrive of user or Drive ID.

Local / NFS

The path must be absolute and exist. The backup service runs as root and writes it. Test also warns if the console cannot read the folder.
A full disk makes writes fail; there is no free-space check.
An NFS share must be mounted.

"Unknown backups found on destination ..., cleanup paused"

A backup on the destination that this server's database does not know has an unreadable manifest, so the cleanup deletes nothing there until it is dealt with. No backup is lost. Rescan destination lists it with the reason. If another BackupWall server writes to the same folder, give each its own path prefix.