Email Forensics

Every authentication check comes back clean and the email still lands in Junk. That contradiction is where Email Forensics starts: full header, SMTP, and infrastructure-history forensics until we find what a pass/fail authentication report can't show.

17+Years in the email channel & deliverability

8+Years building sending infrastructure

Book a Call Send us what you're seeing

How we identify issues

Full header forensics: every hop and every anti-spam field a provider exposes, read in the order it actually matters
Authentication re-verified independently, not taken on the sending platform's word that SPF/DKIM/DMARC passed
SMTP route reconstructed hop by hop, from origin server to inbox, with every relay documented
DNSPulse-powered: every domain and IP touching the send audited for reputation history, not just current blocklist status
Root cause isolated and handed back with a corrective path, not just a diagnosis

What we read firstHeader sample

SCL: 5 spam confidence

SFV: SPM · CAT: SPM filtered as spam

BCL: 0 not a bulk sender

CompAuth: pass identity accepted

Identity can be accepted while reputation still fails. This field set tells us which one broke before we touch anything else.

Why authentication alone doesn't explain it SPF, DKIM, and DMARC prove identity: this message really came from who it says it came from. They say nothing about reputation. Mailbox providers score reputation across a much wider footprint than the sending server, including the abuse history on the sending IP, the domain's age, and, less obviously, the hosting reputation of any website tied to the sending domain. A clean authentication report and a Junk-foldered inbox can both be true at once.

Who this is for Teams who've already checked the obvious: SPF, DKIM, DMARC all pass, no blacklist listings, sending infrastructure looks healthy, and the mail still isn't landing. That's usually where in-house troubleshooting stops. It's where we start.

Real engagements, anonymized

Mind-Benders (2)

The genuinely tricky ones, written up start to finish: the evidence, the dead ends, and the actual root cause. Every engagement below is covered by a signed NDA, so client names, domains, and IPs are withheld. What's left is the diagnostic path itself, unchanged.

Mind-Bender 01 · Enterprise sender, Salesforce Marketing Cloud

SPF pass DKIM pass DMARC pass Filed as Junk

Passed every authentication check. Still landed in Junk.

SPF, DKIM, and DMARC all passed. No blacklist listings. Enterprise-grade sending infrastructure. Outlook filed it as Junk anyway, and the reason had almost nothing to do with the mail server.

Read the full investigation → Mind-Bender 02 · SaaS platform, shared wildcard hosting

SPF pass DKIM pass DMARC pass Threat intel pass URL flagged malicious

A technically clean domain, flagged as a malicious URL.

SPF, DKIM, DMARC, PTR, and threat intelligence all passed. DNSPulse found zero abuse history on the domain. Mail security gateways still classified the link as malicious. The cause was three DNS names away.

Read the full investigation →

Staring at headers that all say pass?

If authentication checks out and the inbox still disagrees, that contradiction is exactly what we investigate. Send us what you're seeing or put time on the calendar directly.

Book a Call Contact us