Complaint spike

Symptoms

Contain the campaign, map complaints to tenant/source and suppress immediately.

• Record the exact SMTP response or service error.
• Capture timestamps, affected domain, VMTA, source IP and queue.
• Preserve relevant log and configuration evidence.

Immediate triage

1. Stop unrelated configuration changes.
2. Determine scope: one tenant, stream, provider, VMTA or the entire service.
3. Protect transactional and critical traffic if queue pressure is growing.
4. Reduce intake only when evidence shows delivery capacity is insufficient.

Diagnostic checks

pmta show status
pmta show queues
pmta show topdomains
journalctl -u pmta --since '30 minutes ago'
# Also inspect accounting logs, DNS, source routing and provider responses.

Decision path

• If only one provider is affected, keep the change provider-specific.
• If only one customer or credential is affected, isolate that identity.
• If authentication fails globally, inspect listener and credential changes.
• If queue age rises across all destinations, inspect DNS, network, storage and service capacity.

Recovery

Apply the smallest reversible change supported by evidence. Confirm service health and send a controlled test before restoring normal intake. Avoid deleting queued mail as a first response.

Verification

• New messages use the intended route and identity.
• Temporary failure rate and oldest-message age improve.
• No new authentication or complaint issue appears.
• Monitoring remains stable through at least one full retry interval.

Prevention

Update the runbook, alert threshold and configuration test that would detect the same failure earlier. Assign a follow-up owner and completion date.