Which domain should I set up in Google Postmaster Tools, the 'Provisioned Full Domain' or the 'Approved From Domain'?

You should set up Postmaster Tools for the domain that is primarily used for authenticating your emails. This is usually the domain that DKIM signs your messages or the Return-Path (Mail From) domain that passes SPF. If your ESP defines a 'Provisioned Full Domain' or 'Approved From Domain,' identify which one aligns with your authentication records.

What if I send emails for a client and don't own their domain?

If you don't own the domain but send emails on its behalf, you have a few options: request that the domain owner grant you delegated access to their Postmaster Tools , or implement double DKIM signing so your own domain also signs the email, allowing you to monitor it in your account.

Can I add multiple sending domains to Google Postmaster Tools?

Google Postmaster Tools allows you to add and verify multiple domains within a single account. You'll add each domain individually and verify it by adding a specific DNS TXT record provided by Google to its DNS settings. This helps you track the reputation of all your sending domains comprehensively.

What are the key metrics to monitor in Google Postmaster Tools?

The main metrics to monitor include Spam Rate, IP Reputation, Domain Reputation , Feedback Loop (FBL), and Authentication (SPF, DKIM, DMARC) status. These dashboards provide crucial insights into how Gmail perceives your sending practices and potential deliverability issues.

How do I set up Google Postmaster Tools to monitor deliverability for provisioned full domain and approved from domain? - Tools - Email deliverability - Knowledge base

Monitoring your email deliverability is crucial for ensuring your messages reach the inbox. Google Postmaster Tools provides invaluable insights into how Gmail views your sending practices. The key question often arises: should you set it up for the 'Provisioned Full Domain' or the 'Approved From Domain'? This distinction typically comes into play when you're using an Email Service Provider (ESP) or sending emails on behalf of clients. Understanding which domain to monitor is fundamental to getting accurate and actionable data. For the most comprehensive deliverability insights, you generally want to monitor the domain that authenticates your emails. This usually means the domain used for DKIM signing or the Return-Path domain (also known as the Mail From or Bounce domain) for SPF authentication. If your ESP provisions a full domain or a subdomain for you, or if you have an approved 'from' domain, the one that actively participates in these authentication checks is the one you need to add to Google Postmaster Tools. This ensures the data reflects the reputation of the entity Google actually associates with your outgoing mail. The good news is that setting up Google Postmaster Tools isn't overly complicated, but it does require access to your domain's DNS records. Once set up, you'll gain access to critical dashboards that show your spam rate, IP reputation, domain reputation, feedback loop data, and more. These metrics are vital for diagnosing and resolving email deliverability issues, preventing your emails from landing in the spam folder, and maintaining a healthy sending reputation. Let's walk through the process.

Adding and verifying your domain

To begin monitoring, you first need to add your sending domain to Google Postmaster Tools. This is the domain that appears in your email headers and is used for authentication. Navigate to the Google Postmaster Tools dashboard and click the plus icon to add a new domain. Enter your root domain, even if you send from subdomains. After adding, Google will provide a TXT record that you need to add to your domain's DNS settings. This record proves you own the domain or have authority over it. It's a critical step in the domain verification process. If you are working with an ESP, they might provide specific instructions or even handle this for you. Once the DNS record is published and propagated, return to Postmaster Tools and click 'Verify.' This typically takes a few minutes, but can sometimes take longer depending on your DNS provider.

Example DNS TXT record for verificationdns

TXT record name: google._domainkey.yourdomain.com
TXT record value: v=spf1 include:_spf.google.com ~all

When verifying, prioritize the domain that authenticates your mail, specifically the one that aligns with your DKIM or SPF records. In many ESP setups, the 'Approved From Domain' is the one that receives the DKIM signature, meaning Google Postmaster Tools will primarily report on its reputation. If your ESP uses a separate 'Provisioned Full Domain' for things like the Return-Path, but the 'From' address domain is what's DKIM-signed, then the latter is generally what you want to monitor in Postmaster Tools for primary reputation signals. I've found that paying close attention to which domain Google is actually using for its authentication checks, as seen in your email headers, will guide you to the correct domain to add. The system will aggregate data across each domain that authenticates a message, whether it's the DKIM domain or the Return-Path domain. Adding the organizational domain (e.g., yourcompany.com) first allows you to then monitor specific subdomains or authentication domains and understand their individual impact on the overall reputation.

Monitoring domains you don't fully control

Sometimes, you might not have direct ownership or DNS access to the client's domains for which you're sending emails. In these scenarios, directly adding their domain to your Google Postmaster Tools account for monitoring is impossible. However, there are workarounds to still gain valuable insights. One approach is to request that the client provide you with delegated access to their Postmaster Tools account. Many clients are willing to do this once they understand the benefits of proactive deliverability monitoring. Another powerful method is to implement double DKIM signing. This involves signing the email with your client's domain (as usual) and adding a second DKIM signature from your own domain. When done correctly, the second DKIM signature won't negatively impact the email but will allow your domain to be recognized and monitored within your Google Postmaster Tools account. This gives you a visibility window into how Google perceives the campaigns sent on behalf of your clients, even if you don't have direct access to their specific domain's Postmaster data.

Direct domain monitoring

Access: Requires DNS control or delegated access for the domain you wish to monitor.
Data scope: Provides granular data specific to that domain's reputation, spam rates, and authentication.
Applicability: Ideal for your primary sending domains or domains where you have full control.

Monitoring client domains without direct access

When sending emails on behalf of clients using their 'From' domains, monitoring their domain's specific deliverability metrics can be challenging without direct Postmaster Tools access. In such cases, you need alternative strategies to gauge performance and prevent issues.

Delegated access: Clients can grant you access to their Postmaster Tools.
Double DKIM signing: Sign with both the client's domain and your own domain's DKIM.
IP reputation monitoring: Monitor the dedicated IPs you use, as they also contribute to deliverability.

Even if you can't monitor the client's domain directly, continuously monitoring the IP reputation of your dedicated sending IPs is critical. IP reputation is a significant factor in how mailbox providers (like Gmail and Yahoo) evaluate incoming mail. A healthy IP reputation can mitigate some issues related to a less-than-perfect domain reputation, especially if you're sending from shared IPs where other senders' practices might influence your deliverability. This dual approach provides a more complete picture of your email program's health.

Understanding Postmaster Tools dashboards

Once your domain is verified, you gain access to a suite of dashboards within Google Postmaster Tools. These dashboards offer crucial insights into your email program's performance with Gmail. Regularly checking these metrics is paramount for proactive deliverability management. You'll want to pay close attention to the spam rate, which indicates how many of your messages are being marked as spam by users or automatically classified as such. A high spam rate is a strong signal of reputation issues and can quickly lead to emails being blocked or sent to the spam folder. The IP and domain reputation dashboards provide an overall health score for your sending infrastructure. A low or bad reputation indicates significant deliverability problems. The Feedback Loop (FBL) dashboard shows you specific campaigns that users are marking as spam, allowing you to identify problematic content or audience segments. Additionally, the authentication and encryption dashboards confirm your SPF, DKIM, and DMARC records are correctly configured and passing, which are essential for trust and deliverability.

By actively monitoring these key metrics, you can quickly spot emerging issues and take corrective action. For instance, if your spam rate suddenly spikes, you can investigate recent campaigns for content, list hygiene, or sending frequency issues. A drop in authentication success might signal a DNS misconfiguration that needs immediate attention. Postmaster Tools gives you the data to make informed decisions and maintain healthy email sending practices, helping you avoid common pitfalls like being placed on a blocklist (or blacklist).

Key Google Postmaster Tools Dashboards

Dashboard	What it shows	Why it's important
Spam Rate	Percentage of mail marked as spam by users or Gmail filters.	Direct indicator of recipient engagement and content relevance.
IP Reputation	How Gmail rates the IP address(es) sending your email.	Crucial for inbox placement, especially for high volume senders.
Domain Reputation	How Gmail rates your sending domain based on various factors.	A primary factor influencing deliverability and trust.
Feedback Loop	Reports of messages marked as spam by Gmail users.	Helps identify content or list segments causing complaints.
Authentication	Shows SPF, DKIM, and DMARC authentication pass/fail rates.	Essential for email security and proving sender legitimacy.

Beyond Postmaster Tools

While Postmaster Tools focuses on Google, remember that deliverability is a multi-faceted challenge. Your efforts to maintain a good reputation with Google will often positively impact your standing with other mailbox providers like Yahoo! and Microsoft (Outlook). Implementing robust email authentication, maintaining clean mailing lists, and sending engaging content are universal best practices. Continuous monitoring and adaptation are key. Email deliverability isn't a set-it-and-forget-it task, especially with evolving sender requirements from major mailbox providers. Regular review of your Postmaster Tools data, combined with other deliverability best practices, will help ensure your emails consistently reach the inbox.

Views from the trenches

Best practices

Always set up Postmaster Tools for the domain that provides your DKIM signature, as this is often the most impactful domain for reputation.

If sending on behalf of clients, encourage them to grant you delegated access to their Google Postmaster Tools account for direct insights.

Implement double DKIM signing with your own domain if direct client domain monitoring isn't feasible to gain some visibility.

Common pitfalls

Confusing the 'From' domain with the domain that actually authenticates the email, leading to incorrect Postmaster Tools setup.

Neglecting to monitor IP reputation, assuming domain reputation alone is sufficient for deliverability health.

Not having a strategy for monitoring client domains when sending on their behalf, leading to blind spots in deliverability.

Expert tips

Remember that Google Postmaster Tools aggregates data across every domain that authenticates a message, whether via DKIM or the Return-Path.

For clients, setting up their organizational domain in Postmaster Tools allows monitoring of both the main domain and any subdomains or authentication domains.

When direct domain access is difficult, explore options like requesting client access or implementing secondary DKIM signing from your own domain.

Expert view

Expert from Email Geeks says to set up Google Postmaster Tools for the domain used to DKIM sign the message. It's often the provisioned full domain, depending on the ESP.

2023-03-29 - Email Geeks

Marketer view

Marketer from Email Geeks says that in Acoustic, the Approved From Domain is the one that's confirmed in Gmail for DKIM signing.

2023-03-29 - Email Geeks

Key takeaways for deliverability

Setting up Google Postmaster Tools is a fundamental step in mastering your email deliverability. The key takeaway is to monitor the domain that actively participates in the authentication of your emails, which is typically your DKIM-signing domain or your Return-Path (Mail From) domain. Whether it's a 'Provisioned Full Domain' from your ESP or an 'Approved From Domain' used for client sending, ensure its DNS records are correctly configured for verification. Proactive monitoring of your domain and IP reputation, spam rates, and authentication results provides the insights needed to troubleshoot issues, avoid blacklists (or blocklists), and optimize your sending practices. Even when managing emails for clients without direct domain access, strategies like delegated access or double DKIM signing can ensure you maintain crucial visibility into deliverability performance. By integrating Postmaster Tools into your routine, you gain a powerful ally in your quest for consistent inbox placement.