How investigations work

An investigation tracks one authentication question through its fix and its verification. For example: an unfamiliar service is sending as your domain, or a service you use is failing DKIM.

What you see

Each investigation says what is known, what is still uncertain, and what it is waiting for: your confirmation, an approval, a DNS change you publish, or new reports. Pending investigations are open; resolved ones keep their outcome and history.

What you do

Usually one thing: answer the question it asks, such as whether you use a service, then review the suggested fix. Any DNS change is reviewed and approved separately.

Where they appear

Investigations lists them for all your domains. Attention lists everything waiting on a person, most urgent first. In the API they are called cases.