Guides
Practical answers for the incident in front of you.
Each guide starts with observable evidence, cites official sources and says what the available data cannot prove.
SMTP codes are a combination, not a single number
Read the reply class, the enhanced status and the text together. A 550 with 5.1.1 is not the same case as a 550 with 5.7.1.
What PunchOp investigates — and what it does not
PunchOp reconstructs one email’s path from application, SMTP and provider evidence. It does not purge phishing or prove inbox placement from a 250 OK.
DMARC aggregate report (RUA): read the google.com!domain.zip file
What a DMARC RUA ZIP from Google means, how to read SPF fail with DKIM pass, and when it is an incident signal versus normal ESP sending.
Enable Gmail logs BigQuery export (lab-tested checklist)
Admin steps to turn on Gmail log export to BigQuery, validate the schema, and run a bounded incident query.
Google Workspace SMTP relay logs: investigate a failed email
A practical evidence checklist for finding an application or device email in Google Workspace and deciding what to check next.
Email Log Search shows no results: what to check
Turn an empty Google Workspace Email Log Search into a structured sequence of checks instead of a delivery conclusion.
Google Workspace SMTP relay errors: read the complete response
Use the complete SMTP code and response text to choose the right diagnostic branch for authentication, relay denial and limits.