Sending-domain reputation drop
Evidence-first recovery runbook for sending-domain reputation drop.
Use responsibly. Apply these controls only to permission-based email programs and validate changes in a controlled environment.
Detection
Record the first observed time, provider, source IP, domain, VMTA, tenant, campaign and full SMTP response. Preserve dashboards and configuration checksums.
Containment
Stop rate increases and isolate the affected stream. Do not make broad changes before defining the scope.
Verification
- Confirm DNS and authentication.
- Compare current metrics with the provider-specific baseline.
- Inspect complaints, bounces, unknown users and queue age.
- Identify the first change preceding the incident.
Recovery
Correct the verified cause, use a small canary, monitor provider responses and expand only when recovery gates remain stable.
Prevention
Add a monitoring threshold, ownership control, staging test or suppression rule that detects the same failure earlier.