Guides

Practical answers for the incident in front of you.

Each guide starts with observable evidence, cites official sources and says what the available data cannot prove.

DMARC aggregate report (RUA): read the google.com!domain.zip file

What a DMARC RUA ZIP from Google means, how to read SPF fail with DKIM pass, and when it is an incident signal versus normal ESP sending.

Admin steps to turn on Gmail log export to BigQuery, validate the schema, and run a bounded incident query.

A practical evidence checklist for finding an application or device email in Google Workspace and deciding what to check next.

Turn an empty Google Workspace Email Log Search into a structured sequence of checks instead of a delivery conclusion.

Use the complete SMTP code and response text to choose the right diagnostic branch for authentication, relay denial and limits.