Freeze definitions and coverage

Record the review period, UTC boundaries, active streams/domains/IPs/providers, audience segments, and source freshness. Define accepted, delivered, complaint rate, permanent/temporary failure, authentication pass/alignment, and placement observation. If a provider uses a different denominator, show it separately.

Mark missing or delayed data. Google states that Postmaster data is delayed, limited to personal Gmail traffic, and may be absent at low volume. Do not convert no data to a perfect score.

Review five evidence groups

  1. Identity and authentication: SPF dependencies/results, DKIM selectors/rotation/results, DMARC policy/alignment/reports, DNS changes.
  2. Audience and permission: acquisition sources, confirmation, list age, frequency drift, unsubscribe/complaint propagation, imports, suppression reconciliation.
  3. Delivery and placement: SMTP response classes, queue latency, provider errors, controlled seeds with unknowns, recipient support reports.
  4. Reputation and providers: official dashboards, feedback loops, source-specific blocklists, provider outages/quotas/licenses.
  5. Security and privacy: credential rotation, abuse/rate events, raw-message access, retention/deletion failures, webhook verification, open incidents.

Segment by stream and provider. Overall averages can hide one failing transactional route or one abusive acquisition partner.

Verify last month’s actions

For every remediation, check the promised evidence: fresh message, DNS query, provider event, suppression test, deletion fixture, or alert. Close only with an outcome and date. Escalate overdue high-impact items to the accountable owner.

Choose this month’s work

Rank findings by customer/security impact, evidence strength, scope, and reversibility. Assign owner, due date, containment, success measure, and rollback. Avoid generic actions such as “improve reputation.”

Publish a safe receipt

Summarize scope, material changes, unresolved unknowns, incidents, actions, approvers, and next review. Link to restricted evidence rather than embedding addresses, message bodies, or secrets. Update source links when provider guidance changes.

The review succeeds when it changes an owned control and verifies the effect. There is no universal sender-health number; the evidence and closed actions are the product.