Google Postmaster Tools

Earlier this month Google announced a new set of tools for senders at their Postmaster Tools site. To get into the site you need to login to Google, but they also have a handy support page that doesn’t require a login for folks who want to see what the page is about.
We did register, but don’t send enough mail to get any data back from Google. However, the nice folks at SendGrid were kind enough to share their experiences with me and show me what the site looked like with real data, when I spoke at their recent customer meeting.
Who can register?
Anyone can register for Google Postmaster tools. All you need is the domain authenticated by DKIM (the d= value) or by SPF (the Return Path value).
Who can see data?
Google is only sharing data with trusted domains and only if a minimum volume is sent from those domains. They don’t describe what a trusted domain is, but I expect the criteria include a domain with some history (no brand new domains) and a reasonable track record (some or all of the mail is good).
For ESPs who want to monitor all the mail they send, every mail needs to be signed with a common d= domain. Individual customers that want their own d= can do so. These customers can register for their own access to just their mail.
ESPs that want to do this need to sign with the common key first, and then with the customer’s more selective key.
How does it work?
Google collects data from DKIM and/or SPF authenticated mail, aggregates it and presents it to a Google user that has authenticated the domain.
How do I authenticate?

1. Go to postmaster.google.com.
2. On the bottom-right, click the + button.
3. In the box that pops up, enter your authentication domain.
4. Next, prove that you own the domain by adding a DNS TXT or a DNS CNAME record.

We recommend adding a CNAME record, rather than TXT records for the purposes of authentication.
Our authentication looks like this:

$ dig dcnsiyncmude.wordtothewise.com
;; ANSWER SECTION:
dcnsiyncmude.wordtothewise.com. 8639 IN CNAME gv-pre4dkkoexiumf.dv.googlehosted.com.
;; AUTHORITY SECTION:
dv.googlehosted.com. 59 IN SOA ns4.google.com. dns-admin.google.com. 99514096 900 900 1800 60

What data is there?
Google provides a number of different dashboards, which they describe in detail on the FAQ page.

• Spam Rate
• Domain & IP Reputation
• Feedback Loop
• Authentication
• Encryption
• Delivery Errors

For most senders the Spam Rate, and Domain & IP Reputation dashboards are going to be the most useful. Authentication and Encryption will be useful for troubleshooting. Delivery Errors is useful, but duplicates information already in sending log files.
Spam Rate
This lets users see how many of their recipients who received the email in their inbox hit the “this is spam” button. This not only gives you an idea of complaints, it can also tell you how much of your mail is making it to the inbox.
Domain & IP Reputation
This shows the reputation of domains and IPs. Google ranks them as Bad, Low, Medium and High. There is a limit to the number of IPs that will be shared and so ESPs with large numbers of IPs may discover that limit. Google will always provide the full list of Bad and Low IPs, so if an IP is not listed, it has either a Medium or High reputation.
Feedback Loop
This information only shows up for senders who have an active FBL with Google.
Conclusion
Overall, I think the Google Postmaster tools will be extremely useful for senders and ESPs who want to understand what’s happening at Gmail. There are some limitations of the current set. One of the big ones is you’re stuck with Google’s reporting, and there’s no way to download the data through an API. Another issue is that it’s all based on DKIM, and if Provider A uses Provider B as a white label ESP for Customers X, Y and Z, will both Provider A and Provider B have to sign with their shared DKIM keys in order to monitor their customers? Triple DKIM keys aren’t impossible, but there is a processing cost for signing mail.