Why are my emails going to the promotions tab in Gmail? - Knowledge Base

Summary

Identifying all company mail streams and sending tools requires a multi-faceted approach incorporating technical configurations, administrative tools, communication with relevant personnel, and ongoing monitoring. DMARC aggregate reports and DMARC monitoring services provide critical insights into email sending sources and authentication status. Sysadmins and DNS records offer valuable information about mail streams, while email log searches within Google Workspace Admin and Message Trace in Microsoft Exchange help track messages. Regularly auditing systems and applications, including internal mail relays, third-party services, and even IoT devices, is essential. Implementing a comprehensive email authentication strategy (SPF, DKIM, DMARC) and utilizing email testing tools further enhance visibility and control over email streams. A proactive approach is necessary to mitigate risks associated with unauthorized sending and shadow IT.

Key findings

DMARC Aggregate Reports: DMARC aggregate reports identify mail streams by providing data on domain usage, authentication status, and unauthorized sending attempts.
SPF Records & Sysadmins: Checking SPF records and consulting sysadmins can uncover overlooked mail streams.
Admin Console Tools: Google Workspace's Email log search and Microsoft Exchange's Message Trace track messages and filter by various criteria.
Comprehensive Audits: Regular system audits of internal mail relays, third-party services, and IoT devices identify unexpected mail streams.
Email Authentication: Implementing SPF, DKIM, and DMARC provides crucial data for managing and securing email streams.
Email Testing Tools: Email testing tools can analyze headers and provide insights into potential deliverability issues and sending paths.

Key considerations

Communication: Maintain open communication with sysadmins and relevant stakeholders to understand email infrastructure and identify mail streams.
Proactive Approach: Adopt a proactive approach to prevent shadow IT from compromising security and deliverability.
Scope of Audit: Ensure audits encompass all systems capable of sending emails, including often-overlooked devices like IoT.
Technical Expertise: Properly implement and configure email authentication protocols (SPF, DKIM, DMARC) to ensure their effectiveness.
Regular Monitoring: Regularly monitor DMARC reports and email logs to identify and address potential issues promptly.
Importance of Deliverability: Controlling all email streams will help keep sending reputation healthy which then ensures optimal deliverability.

What email marketers say

10 marketer opinions

Identifying all company mail streams and sending tools is crucial for maintaining control over sending reputation, preventing unauthorized sending, and ensuring email deliverability. Key strategies include leveraging DMARC aggregate reports, performing comprehensive email infrastructure audits, reviewing DNS records (SPF, DKIM, DMARC), and using third-party email analysis tools. Auditing internal mail relays, applications, and third-party services is also essential, as is regularly reviewing email sending practices and user accounts. Utilizing email testing tools to analyze email headers helps uncover potential deliverability issues and identifies all mail streams, both legitimate and unauthorized.

Key opinions

DMARC Reports: DMARC aggregate reports provide data on all uses of a domain in the 'From' header, showing authenticated and unauthenticated mail, as well as unauthorized use.
Email Infrastructure Audits: Comprehensive audits of email infrastructure, including reviewing SPF, DKIM, and DMARC records, are essential to identifying all sending sources.
DNS Records: Checking SPF, DKIM, and DMARC records helps identify servers authorized to send email on behalf of a domain, revealing both legitimate and unauthorized sources.
Third-Party Tools: Third-party email analysis tools offer a comprehensive overview of email streams by analyzing email headers and DMARC reports.
Internal Mail Relays: Identifying internal mail relays and applications sending emails directly is crucial, involving reviewing server configurations and application settings.
Regular Audits: Regularly auditing email sending practices, user accounts, and third-party integrations ensures all sending sources are accounted for.
Third-Party Services: Inventorying third-party services and integrations sending emails on your behalf helps ensure proper configuration and authentication.
Email Testing Tools: Email testing tools analyze email headers and provide insights into email paths and authentication status, aiding in identifying all mail streams.

Key considerations

Sending Reputation: Identifying all mail streams is critical for maintaining control over your sending reputation and ensuring email deliverability.
Unauthorized Sending: Knowing all sending sources helps prevent unauthorized sending and potential security breaches.
Configuration and Authentication: Ensure all third-party services are properly configured and authenticated to prevent deliverability issues.
Internal Sources: Don't overlook internal mail relays and applications that might be sending emails directly, as they are often missed in audits.
DMARC Setup: Implementing and monitoring DMARC is essential for gaining visibility into all email streams using your domain.
Proactive Approach: Adopt a proactive approach to identifying and managing email streams to prevent deliverability issues and security risks.

Marketer view

Email marketer from Reddit suggests using third-party email analysis tools to identify all sending sources. These tools analyze email headers and DMARC reports to provide a comprehensive overview of your email streams, including those you may not be aware of.

19 Sep 2021 - Reddit

Marketer view

Email marketer from EmailOnAcid recommends performing a comprehensive email infrastructure audit to identify all email sending sources. This audit should include reviewing SPF, DKIM, and DMARC records, as well as examining internal systems and applications that send emails.

23 Mar 2023 - EmailOnAcid

What the experts say

4 expert opinions

Identifying all company mail streams involves a multi-faceted approach encompassing technical configuration, communication, and monitoring. Checking SPF records and consulting with sysadmins can reveal overlooked mail streams. Implementing a comprehensive email authentication strategy with SPF, DKIM, and DMARC, coupled with regular monitoring of DMARC reports, provides visibility into sending sources. Utilizing DMARC monitoring services further aids in tracking email streams. Additionally, auditing all systems and applications capable of outbound connections, including servers, marketing platforms, and even IoT devices, is crucial for uncovering unexpected mail streams and mitigating risks associated with shadow IT.

Key opinions

SPF Records & Sysadmins: Checking SPF records and consulting with sysadmins can reveal overlooked or unknown mail streams.
Comprehensive Email Authentication: Implementing SPF, DKIM, and DMARC is crucial for identifying and managing all email streams.
DMARC Monitoring: Regularly monitoring DMARC reports provides visibility into sending sources and helps manage email streams.
DMARC Monitoring Services: DMARC monitoring services offer detailed reports on sending sources, authentication results, and potential security issues.
System Audits: Auditing all systems and applications capable of outbound connections helps uncover unexpected or unauthorized mail streams.

Key considerations

Communication: Communicate with sysadmins to gain insights into network configurations and potential mail streams.
Implementation of Authentication: Properly implement and configure SPF, DKIM, and DMARC for effective email stream management.
Regular Monitoring: Regularly monitor DMARC reports to identify and address any issues related to sending sources.
Proactive Approach: Adopt a proactive approach to prevent shadow IT from compromising email deliverability and security.
Scope of Audit: Ensure the audit encompasses all systems and applications, including IoT devices, capable of sending emails or alerts.

Expert view

Expert from Spam Resource explains that implementing a comprehensive email authentication strategy, including SPF, DKIM, and DMARC, is crucial for identifying and managing all email streams. This involves setting up these authentication methods and regularly monitoring DMARC reports to gain visibility into all sending sources using your domain.

16 Feb 2024 - Spam Resource

Expert view

Expert from Spam Resource recommends using a DMARC monitoring service to help identify and track all email streams using your domain. These services provide detailed reports on sending sources, authentication results, and potential security issues, making it easier to identify both legitimate and unauthorized email streams.

12 May 2025 - Spam Resource

What the documentation says

4 technical articles

Identifying company mail streams and sending tools involves utilizing administrative tools and email authentication protocols. Google Workspace provides the Email log search within the Admin console to track messages. Microsoft Exchange Online offers Message Trace in the EAC. SPF records list authorized mail servers, aiding in the prevention of unauthorized sending. DKIM signatures help ensure emails are properly authenticated, making it easier to identify legitimate streams.

Key findings

Google Workspace Tools: Google Workspace's Email log search enables tracking of messages sent from the domain, filtering by various criteria.
Microsoft Exchange Tools: Microsoft Exchange Online's Message Trace tracks messages through the organization, filtering by sender, recipient, and date range.
SPF Records: SPF records list authorized mail servers for the domain, helping prevent unauthorized sending.
DKIM Signatures: DKIM signatures ensure proper email authentication, making it easier to identify legitimate mail streams.

Key considerations

Admin Console Usage: Utilize the Google Admin console and Exchange Admin Center to track email messages and identify streams.
SPF Record Accuracy: Maintain an accurate and up-to-date SPF record to ensure legitimate email streams are authorized.
DKIM Implementation: Implement and monitor DKIM to properly authenticate emails and identify unauthorized sending sources.
Tool Capabilities: Understand the capabilities of each tool (Google Admin console, Exchange Message Trace) for effective stream identification.

Technical article

Documentation from DKIM explains that DKIM (DomainKeys Identified Mail) signatures can help identify legitimate email streams. By implementing and monitoring DKIM, you can ensure that emails sent from your domain are properly authenticated, making it easier to identify unauthorized sending sources.

29 Oct 2021 - DKIM

Technical article

Documentation from Google Workspace Admin Help explains that you can use the Email log search in the Google Admin console to track messages sent from your domain. This tool allows you to filter by sender, recipient, date, and other criteria to identify all email streams originating from your organization's Google Workspace accounts.

28 Feb 2024 - Google Workspace Admin Help