Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Putting patient identifiers in subject lines.
- Using marketing tools for appointment reminders without a BAA.
Fix and re-verify#
- Sign a BAA with your email provider and any AI or automation vendor touching mailbox content.
- Enforce TLS and use encryption for messages containing ePHI.
- Enable audit logging and retention appropriate to your policy.
- Train staff on what may and may not go in an email body or subject.
Frequently asked questions#
Is Gmail HIPAA compliant?
Google Workspace can be, with a signed BAA and proper configuration. Consumer Gmail is not.