Domain diagnostics
lakesidedental.com · Google Workspace relay · last full check 10:44 · 2 pending, 0 failing
DNS from four resolvers
DKIM pxc2 and pxc3 not yet verified
Status: both CNAMEs exist at your registrar (GoDaddy) but answer with your domain appended — the common GoDaddy quirk. Mail still flows (pxc1 signs); recipients may see “via pxcmail.com”.
- Found
pxc2.dkim.pxcmail.com.lakesidedental.com- Expected
pxc2.dkim.pxcmail.com
Guided fix · 2 steps
- Edit pxc2._domainkey and pxc3._domainkey at GoDaddy
Value with a trailing dot:
pxc2.dkim.pxcmail.com. - Check again
Relay authentication failing since 09:12 — 48 messages queued at Google
Cause: J. Park rotated the relay credential at 09:10; Google Admin still has the old one. Google retries for 24 h.
- Found
535 5.7.8 (last 09:41:55)- Expected
235 ok
Guided fix · 3 steps
- Reveal once → copy the new credential
- Google Admin → Gmail → Routing → Outbound gateway authentication → paste
- Watch the queue drain
Bounce rate 2.1% in the last hour (threshold 2%)
Cause: a bulk send from billing@ to a stale patient list (212 recipients, 9 invalid addresses). Not blocklisted; sending continues with pacing.
- Found
Bounces: 9/212 · complaints: 0- Expected
< 2% bounces
Guided fix · 2 steps
- Clean the list
Remove the 9 bounced addresses (exported for you).
- Use the recall/reminder template with batching
Sends ≤ 50 per minute automatically.
Your domain appears on a public blocklist (Spamhaus DBL) since 06:10
Cause: a compromised account (r.patel@) sent 1,800 messages last night through Google directly (before the gateway was applied to all users). PXCMail paused outbound for r.patel@ at 06:12.
- Found
DBL listing: lakesidedental.com · reason: phishing links- Expected
Not listed
Guided fix · 3 steps
- Reset r.patel@ password and revoke sessions
Done automatically? No — one click here (logged).
- Confirm all users route through PXCMail
Relay-partial check.
- Request delisting
We file the Spamhaus request with evidence; typical 2–24 h.
Relay log (last 24 h)
Google Workspace checklist
- Outbound gateway smtp-out.pxcmail.com:587, TLS required
- Gateway authentication set (username lakesidedental.com)
- Applied at top-level OU (12/12 users)
- SPF includes _spf.pxcmail.com
- DKIM pxc2/pxc3 pending (GoDaddy quirk)
Deep links: Gmail routing · Admin audit log
Microsoft 365 checklist (if you switch)
- Outbound connector “PXCMail outbound” (smart host, TLS cert validation)
- Transport rule routes external mail via connector
- Enhanced filtering for inbound connector (if MX at PXCMail)
- Autodiscover CNAME for Outlook
SMTP codes explained
| Code | Seen | Meaning | Fix |
|---|---|---|---|
535 5.7.8 | today | Relay credential rejected | Update the password in Google Admin / M365 connector (Reveal once) |
550 5.7.1 | — | Receiver rejects: SPF/DMARC fail or blocklist | Check SPF includes PXCMail; DMARC alignment; request delisting |
550 5.7.64 | — | Microsoft: TenantAttribution / relay access denied | Connector certificate domain must match; use smart host with TLS cert validation |
451 4.7.650 | Oct 1 | Microsoft throttling a sending IP pool | Automatic: traffic shifts pools; see status incident |
421 4.7.0 | — | Google rate limit / temporary | Retries automatically for 24 h |
554 5.7.5 | — | Recipient requires TLS; none offered | Policy “Require TLS” already on; recipient server misconfigured — delivered with one-time code instead |
552 5.3.4 | Oct 9 | Message too large for recipient | Attachments over 25 MB are delivered as secure links automatically |
Prototype states: auth · reputation · blocklist · ticket