Getting started
Delivery incident playbook
Contain a block or throttling incident and prepare a useful escalation record.
Classify the incident
Read the full reply, including the remote server and any provider reference. A blocklist match, an authentication failure and a recipient policy rejection require different owners. The same enhanced status code can accompany different explanations.
| Signal | Operational response |
|---|---|
| 4xx SMTP reply | Leave delivery with the configured queue and retry backoff. Investigate a sustained pattern. |
| 5xx SMTP reply | Treat this transaction as failed. Correct the cause before a new submission. |
| Named blocklist | Confirm the listing with the named operator and use that operator’s removal process. |
| Accepted message in spam | Collect full headers and recipient evidence; investigate consent, authentication and stream history. |
Stabilize and investigate
- Assign one incident owner and record when the issue started, which streams are affected and what changed.
- Pause new nonessential traffic to the affected destination when continued sending worsens the incident. Preserve queue state and avoid duplicate submissions.
- Check the actual sending IP, authentication results, recipient acquisition, complaint handling and recent account access.
- Repair the confirmed fault. Use the relevant Proofpoint, Mimecast or Barracuda procedure when the response identifies that service.
Escalate and close
SendPoint recommendation: provide UTC timestamps, sending IPs, the complete response, scope, remediation and a contact who owns the sending system. Remove unrelated recipient data. Resume according to the sending provider’s guidance and observed delivery results, not a universal daily ramp. Record the outcome and a prevention action.