Turn findings into hypotheses

Rewrite every dashboard warning as a specific statement tied to evidence. “DKIM is broken” becomes “Receiver A reported dkim=fail for selector s1 and signing domain example.com on two receipt messages sent at these times.” “Bad content” becomes “No content comparison has yet been run.” This exposes which conclusions are facts and which are guesses.

Group findings by stage: generation, queue, SMTP acceptance, authentication, policy, mailbox observation, or engagement. A reproducible permanent rejection deserves attention before a cosmetic recommendation that has no demonstrated connection to the incident.

Score the next action

For each hypothesis, record:

  • Impact: how much legitimate mail is affected?
  • Confidence: is there direct receiver or server evidence?
  • Scope: one message, one stream, one domain, or all traffic?
  • Reversibility: can the change be rolled back quickly?
  • Owner: who can approve and verify it?

A missing DKIM key used by current production signatures has high confidence and a clear verification path. Rewriting subject lines because one seed landed in spam has lower confidence when authentication and audience evidence are still missing.

Protect against attractive but wrong fixes

An SPF pass does not settle DMARC if the authenticated domain is not aligned. A valid DKIM key lookup does not prove that the received signature verified. A blocklist result for the website host says nothing about a different sending IP. A DMARC enforcement change should not be used as a blind experiment while legitimate senders remain unknown.

Choose the smallest change that tests the strongest hypothesis. Write the current value, proposed value, expected result, observation window, and rollback condition. Obtain the owner’s approval before changing shared DNS or production sender configuration.

Close the loop

After the change, send a new authorized message through the affected path and compare the trusted receiver evidence. Monitor adjacent legitimate streams for regression. If the expected result does not appear, roll back or update the hypothesis; do not stack unrelated changes until the evidence becomes impossible to interpret.

The incident record should end with resolved facts, remaining unknowns, and the next review date. A report is useful when it narrows uncertainty and guides a safe test, not when every colored badge is made green.