Test one real sending route at a time
Send a harmless test from the system you want to investigate to a mailbox you control. Test a normal staff message separately from an invoice, website enquiry and newsletter. Record the sending system, visible From address, recipient service and time. Avoid real customer data and attachments.
Keep the checks read-only initially. Finding a warning is not permission to replace DNS records. Identify who owns the domain configuration before making changes, and retain the original settings for comparison. If a route fails and you need the bigger picture first, check why legitimate business email goes to spam before touching a single record.
Look up the published DNS records for SPF, DKIM and DMARC
Open Google Admin Toolbox Dig, enter the full DNS name and choose the required record type. Public lookups do not require your domain administrator password. Google Admin Toolbox Dig
- For SPF, query TXT at the actual envelope-sender domain used by the sending service. Look for a record beginning v=spf1. Do not assume this is always the visible From domain: SPF checks the SMTP identity. SPF: RFC 7208
- For DMARC, query TXT at _dmarc followed by the visible From domain, for example _dmarc.example.com. A missing record at a subdomain is not conclusive because policy discovery can use the organisational domain. DMARC: RFC 9989
- For DKIM, obtain the selector and signing domain from a received message or the sending system. With s=mail1 and d=example.com, query TXT at mail1._domainkey.example.com. A selector cannot reliably be guessed from the company name. DKIM: RFC 6376
Save the query name, record type, response and check time. A returned record shows published configuration, not that every message uses it successfully. Ask your administrator to investigate unexpected results rather than copying another organisation's records, and if you see a broken SPF value, learn how to fix an SPF record without guesswork.
Read the received header before you share it
In Gmail on a computer, open your test message, choose More beside Reply, then Show original. Google also documents copying the full header into its Admin Toolbox Messageheader analyser to examine the message route. Trace an email with its full header
Look for Authentication-Results, the From address, Return-Path and DKIM-Signature. Compare the DKIM d= domain and SPF identity with the From domain. A successful SPF check alone does not establish DMARC: at least one passing SPF or DKIM identity must also align. DMARC: RFC 9989 If you are unsure what each field means, use the full guide to reading email headers safely.
Prefer reading the original locally first. Headers can reveal email addresses, IP addresses, message identifiers and subject text. Do not paste confidential headers into a public forum or external analyser without authorisation. Use a synthetic test message where possible; redacting signed fields can make later signature checks invalid. Never share passwords, DKIM private keys or account recovery information.
Use Google Postmaster Tools when you have access
Google's Postmaster Tools provides Gmail-specific authentication, reputation, spam and delivery-error dashboards. You need a Google or Google Workspace account, and the sending domain must be verified before its data appears. An existing verified owner can grant another account access. Get started with Postmaster Tools
Ask the domain administrator to publish the verification record through the normal change process. The dashboards cover messages to personal Gmail accounts, not your entire recipient list. Low daily volume can leave data unavailable to protect users' privacy; an empty chart is not a clean bill of health. Get started with Postmaster Tools Reputation problems show up over time, so treat this as one Gmail-specific signal among several.
Turn the findings into one concrete next action
Keep a short log: route tested, DNS evidence, receiver result, suspected cause, owner and next check date. Repeat the same route after an approved change. If authentication passes but delivery remains poor, review recipient expectations and complaints rather than repeatedly altering DNS. Google explicitly says it cannot guarantee that a provider's messages will pass Gmail's spam filters. Email sender guidelines
These are instructions for genuine external tools and mailbox features, not a SenderCompass scanner. No paid monitoring product or affiliate signup is required by this guide.
If free evidence is not enough, see how to choose monitoring software or specialist help and what email tools cost over a year. For the wider reputation picture, including Gmail and provider signals, read how blocklist monitoring changes once you know that evidence matters.
If free evidence cannot answer the decision, use the tool selection guide to compare monitoring software or specialist help without buying features blindly.
Sources and further reading
- Trace an email with its full header
- Google Admin Toolbox Dig
- Get started with Postmaster Tools
- Email sender guidelines
- SPF: RFC 7208
- DKIM: RFC 6376
- DMARC: RFC 9989