GPT -- Google Postmaster Tools (or Gmail Postmaster Tools) is a truly handy thing for email senders, especially email marketers who need data and deliverability monitoring. It is a reputation dashboard that pulls together IP address reputation, domain reputation, bounce and complaint metrics, and more, all in one handy interface.
GPT is domain-based, meaning that you configure it to provide you data on either your return-path or visible from domain, authenticated by way of SPF and DKIM. You tell GPT which domains you want to monitor, and you then prove that you own or have admin access to each given domain by implementing a key string in a TXT record to demonstrate that ownership.
Deliverability consultants and marketing managers can use the data to great success -- showing proof that whatever changes (strategic, technical, segmentation, etc.) made to a marketing program are showing improvement as measured by the good/bad reputation indicators for sending IPs and domains -- here's an example from my savvy industry colleague Josie Garcia doing just that.
A friend recently had a client who asked -- is this process secure? What are the ramifications of implementing that DNS record to prove ownership, and what about GPT overall? What does it share? Does it leak PII? For those of you worried about the security implications of GPT, read on!
First, be sure to review and familiarize yourself with Google’s own Postmaster Tools documentation (that can be found here). Or at least bookmark it for future reference.
When signing up for GPT for a given domain, you demonstrate your ownership (or at least that you have appropriate admin access) to a given domain by implementing a DNS record. This is typically a TXT record implemented at the top level. That TXT record contains "google-site-verification" followed by a unique string. Implementing this string is not what causes Google to track reputation data about email sends for a given domain -- Google already tracks that information for internal use (primarily spam filtering) and the intent is to give a user access to some level of the data that Google is already collecting.
Implementing the TXT record itself should not change how visitors come to, find or see your website. Nor will it impact inbound email traffic (or other traffic). The TXT record is publicly visible, but has no value or expected use to anyone at all, beyond Google using it to verify domain ownership.
Google uses this verification process for any of their domain-based services -- Postmaster Tools, Google Search Console, Google Workspace, etc. But verifying your domain for one service (such as GPT) does not automatically enroll a domain into other services.
For those concerned about implementing a TXT record at the top level of a domain, Google offers an alternate method -- you can verify domain ownership via a CNAME record instead. (You’ll see this option on the "Domain Verification" screen near where it says "Having trouble?") A CNAME record may be less visible to the public at large. I can’t think of any way that either the TXT or CNAME record would be more or less of a security risk to implement.
Does implementing GPT leak PII? Not that I’ve seen, and not based on my personal understanding of what would constitute personally identifiable information in this context. I’m not a lawyer, of course, so consult one as needed. But GPT does not seem to intentionally provide any mechanism to identify email addresses, or names, or other individualistic identifiers at the email subscriber level. In other words, GPT users with access to GPT data for your domain cannot see email addresses of people you send mail to. The data GPT provides is aggregated data, and a "sizable daily volume of email traffic" must be sent before GPT would categorize and report on that email send stream. In other words, if you send only to a single recipient, GPT will not report on it -- Google’s intent is to prevent the GPT information from being used to identify individual messages or individual recipients.
GPT has a "feedback ID" identifier that allows senders to tag various mail streams for identification purposes. This allows GPT users to break out reputation data for certain mail streams separately. Inside of this feedback ID process, the same limitations/requirements apply, in that GPT also works to prevent "feedback ID" tracking from being used to identify individual sends to individual recipients. (This can be confusing -- other mailbox providers utilize a similarly named "Feedback Loop" mechanism that often does provide individual sender and recipient data at the per-subscriber level. Google, however, does not.)
In closing, GPT is a valuable deliverability tool that allows a savvy sender to get a better understanding of how Google views their reputation. Implementing and monitoring GPT does not seem to change how Google treats mail from a given domain, though its feedback may be useful for senders who wish to modify and improve their send practices.
GPT is broadly consulted by email marketing managers and deliverability consultants regularly, and I’ve never seen any reports of security issues (or even legitimate security concerns) over the GPT signup practice or from the data provided from the GPT dashboards.
Of course, Google’s view of your sending reputation could be considered competitive data that you may prefer not to share with other marketers, especially those at companies you directly compete with. GPT’s authentication and user access process makes it simple to ensure that you allow data visibility only to those you wish to provide that access to.
GPT -- Google Postmaster Tools (or Gmail Postmaster Tools) is a truly handy thing for email senders, especially email marketers who need data and deliverability monitoring. It is a reputation dashboard that pulls together IP address reputation, domain reputation, bounce and complaint metrics, and more, all in one handy interface.
GPT is domain-based, meaning that you configure it to provide you data on either your return-path or visible from domain, authenticated by way of SPF and DKIM. You tell GPT which domains you want to monitor, and you then prove that you own or have admin access to each given domain by implementing a key string in a TXT record to demonstrate that ownership.
Deliverability consultants and marketing managers can use the data to great success -- showing proof that whatever changes (strategic, technical, segmentation, etc.) made to a marketing program are showing improvement as measured by the good/bad reputation indicators for sending IPs and domains -- here's an example from my savvy industry colleague Josie Garcia doing just that.
A friend recently had a client who asked -- is this process secure? What are the ramifications of implementing that DNS record to prove ownership, and what about GPT overall? What does it share? Does it leak PII? For those of you worried about the security implications of GPT, read on!
First, be sure to review and familiarize yourself with Google’s own Postmaster Tools documentation (that can be found here). Or at least bookmark it for future reference.
When signing up for GPT for a given domain, you demonstrate your ownership (or at least that you have appropriate admin access) to a given domain by implementing a DNS record. This is typically a TXT record implemented at the top level. That TXT record contains "google-site-verification" followed by a unique string. Implementing this string is not what causes Google to track reputation data about email sends for a given domain -- Google already tracks that information for internal use (primarily spam filtering) and the intent is to give a user access to some level of the data that Google is already collecting.
Implementing the TXT record itself should not change how visitors come to, find or see your website. Nor will it impact inbound email traffic (or other traffic). The TXT record is publicly visible, but has no value or expected use to anyone at all, beyond Google using it to verify domain ownership.
Google uses this verification process for any of their domain-based services -- Postmaster Tools, Google Search Console, Google Workspace, etc. But verifying your domain for one service (such as GPT) does not automatically enroll a domain into other services.
For those concerned about implementing a TXT record at the top level of a domain, Google offers an alternate method -- you can verify domain ownership via a CNAME record instead. (You’ll see this option on the "Domain Verification" screen near where it says "Having trouble?") A CNAME record may be less visible to the public at large. I can’t think of any way that either the TXT or CNAME record would be more or less of a security risk to implement.
Does implementing GPT leak PII? Not that I’ve seen, and not based on my personal understanding of what would constitute personally identifiable information in this context. I’m not a lawyer, of course, so consult one as needed. But GPT does not seem to intentionally provide any mechanism to identify email addresses, or names, or other individualistic identifiers at the email subscriber level. In other words, GPT users with access to GPT data for your domain cannot see email addresses of people you send mail to. The data GPT provides is aggregated data, and a "sizable daily volume of email traffic" must be sent before GPT would categorize and report on that email send stream. In other words, if you send only to a single recipient, GPT will not report on it -- Google’s intent is to prevent the GPT information from being used to identify individual messages or individual recipients.
GPT has a "feedback ID" identifier that allows senders to tag various mail streams for identification purposes. This allows GPT users to break out reputation data for certain mail streams separately. Inside of this feedback ID process, the same limitations/requirements apply, in that GPT also works to prevent "feedback ID" tracking from being used to identify individual sends to individual recipients. (This can be confusing -- other mailbox providers utilize a similarly named "Feedback Loop" mechanism that often does provide individual sender and recipient data at the per-subscriber level. Google, however, does not.)
In closing, GPT is a valuable deliverability tool that allows a savvy sender to get a better understanding of how Google views their reputation. Implementing and monitoring GPT does not seem to change how Google treats mail from a given domain, though its feedback may be useful for senders who wish to modify and improve their send practices.
GPT is broadly consulted by email marketing managers and deliverability consultants regularly, and I’ve never seen any reports of security issues (or even legitimate security concerns) over the GPT signup practice or from the data provided from the GPT dashboards.
Of course, Google’s view of your sending reputation could be considered competitive data that you may prefer not to share with other marketers, especially those at companies you directly compete with. GPT’s authentication and user access process makes it simple to ensure that you allow data visibility only to those you wish to provide that access to.
Comments
Post a Comment
Comments policy: Al is always right. Kidding, mostly. Be polite, please and thank you.