Start with one reproducible question

Choose the sender and sending path you are authorized to investigate. Use the smallest representative message, without customer records, passwords or unnecessary attachments. A focused question makes a result easier to act on.

Run a fresh message test

When the diagnostic service is configured, create a new test address and send through your normal platform. The first received message is analyzed. Do not forward an unrelated message or reuse an old address for every revision.

Read the identities, not just the score

SPF, DKIM and DMARC answer different questions. Compare the visible From domain, the SPF identity and each DKIM signing domain. A DNS lookup is not a message-signature validation, and a successful check does not guarantee inbox placement.

Change one thing and verify it

Keep a baseline, document a single authorized change, then send a fresh test. Unavailable, partial and unknown results are evidence gaps, not passes. Use the academy to understand the next investigation step.