Scope the failure
Use timestamps, queue IDs, remote responses, source IP, VMTA, sender domain and message class to establish the failure boundary. Avoid reacting to one isolated delivery attempt.
Sender checks
- DNS resolution and MX reachability
- TLS negotiation and certificate chain
- Valid HELO/PTR identity
- Message formatting and line length
Decision
When multiple independent senders receive the same response, the receiver may be impaired. When only one source IP or message stream is affected, investigate sender identity and policy first.
Operational rule: collect evidence before changing policy, make one controlled change, verify the result, and retain a rollback path.