Contain before diagnosing
The first response to a damaged domain is limiting further harm. GTM's recovery tracking records the failure as an event, pauses affected sending where configured, and gates exports so the damaged rows stop propagating into sequencers while the cause is investigated.
- Pause inboxes on the affected domain.
- Let export gating hold back rows tied to the domain.
- Keep the recovery event open until the resolution is recorded.
Diagnose with public signals
Most domain damage shows up in observable places: DNSBL listings, broken SPF or DKIM records, DMARC failures from unauthorized sources, or collapsed engagement in connected sequencers. Check the observable causes before assuming the domain itself is unsalvageable.
- Run a blacklist check across major DNSBLs.
- Re-verify SPF, DKIM, and DMARC records for drift.
- Review DMARC aggregate sources for unauthorized senders.
Choose recovery or replacement explicitly
Recovery makes sense when the cause is fixable and the domain has accumulated value. Replacement makes sense when diagnosis points to sustained reputation damage. Either way, destructive actions run through an approval step, apply fail-closed, and leave the workspace consistent if a step errors.