PunchOp
Menu
Use casesGuidesCompareGlossaryNewsMethodParticipateJoin inspector beta →Submit a difficulty →
FR
Participate
Join inspector betaSubmit a difficulty
Use caseOct 9, 2026Checked Oct 8, 2026

An internal system says it sent the email—but the logs are unclear

How PunchOp would structure an SMTP relay investigation when an internal application reports success and the Workspace evidence is incomplete.

Public problem signal

A Google Workspace administrator described internal systems that used Gmail relay and produced failures that were difficult to understand from the available logs. This is a public, self-reported incident—not a PunchOp customer result.

How PunchOp would investigate

  1. Capture the application’s timestamp, source IP, sender, recipient and complete SMTP response.
  2. Establish whether the application connected directly to Google or passed through another relay.
  3. Search Workspace evidence using the strongest identifier available.
  4. Align application and provider observations on one timeline.
  5. Mark each event as observed, inferred or missing.
  6. Recommend the next check without inventing an event.

Expected output

The useful deliverable is not a generic dashboard. It is a compact case record showing what the application observed, what Google recorded, where the accounts disagree and which team owns the next check.

What remains unproven

PunchOp has not reproduced this exact public incident. The current research does not establish that Reports API or BigQuery contains every field needed for it.

What this evidence can and cannot prove

Application “success” logs prove the application’s view of the handoff. Workspace relay logs prove Google’s recorded view when an event exists. Neither alone proves recipient inbox state. PunchOp would label each fact as observed, inferred or missing—not collapse them into one delivery verdict.

If the message never appears in Google

That gap often means the send never reached Google’s logged path (wrong relay, auth failure before logging, or misaligned search identities)—not that PunchOp can invent the missing event. The next owner may be networking, the application vendor, or ESP logs outside Workspace.

How this differs from a point tool or a DMARC report

This incident class is message-level relay forensics, not DNS checks or daily DMARC statistics. SIEM dashboards and DMARC platforms may help after you know which source to query; they do not replace confirming whether Google saw the SMTP session. See multi-ESP observability vs Google native evidence.