PunchOp answers one question: why did this email arrive, fail to arrive, or why is the evidence not enough to say?
That is a delivery investigation. It is not a phishing-response product. Tools sold as “email incident investigation” often classify a reported message and remove the same campaign from every mailbox. PunchOp does not triage abuse queues, purge inboxes, or detect malware.
The case PunchOp aims to produce
For one message, a useful record has four parts:
- Sending path — which application, relay, or provider the available evidence actually shows.
- Timeline — each event labeled with its source (application log, SMTP response, Email Log Search, Reports API, BigQuery, DMARC aggregate).
- Gaps — what was searched, what is missing, and what that absence does not prove.
- Next check — the smallest next source that could confirm or reject the open question.
An inference stays labeled as an inference. A missing log is not rewritten as “Google lost the message.”
What a proof allows
| Observation | What it supports | What it does not support |
|---|---|---|
| Application “sent” | The app handed the message to a library, queue, or local server | Acceptance by Google, or delivery to the recipient |
SMTP 250 |
That server accepted the message for the transaction you captured | Inbox placement, a later quarantine, or a read |
| Email Log Search hit | Google logged a matching message for the identities and window you searched | That every copy reached an inbox |
| Empty Email Log Search | This search found no row | Loss, rejection, or spoofing |
| DMARC aggregate row | How receivers evaluated SPF/DKIM alignment for a source over a window | One user’s missing message |
A third-party sender (an ESP, another relay, a direct MX) can be invisible in Google Workspace admin logs. The next evidence may live outside Google.
What PunchOp does not promise
- Finding and deleting a phishing campaign across every mailbox.
- A SIEM, a spam filter, or a replacement for Email Log Search and BigQuery.
- “AI root cause,” or a claim that every sender on a domain has been discovered.
- An event that no system recorded.
Google Workspace is the first path because that is where the lab and the guides start. Mail that never touched Google still needs the system that actually handled it.
Where this stands
The inspector is in development. Guides on this site describe how to read the evidence. They are not a measured claim that PunchOp already explains most incidents. See the evidence method and the lab evidence matrix.