Compromised SMTP credential
Decision-tree troubleshooting guide for unexpected mail is submitted with valid authentication in PowerMTA environments.
PowerMTAv4.1 frameworkProduction reference
Review before production. Adapt hostnames, IPs, credentials, paths and limits to your licensed PowerMTA release and validate syntax in a staging environment.
Symptom
Unexpected mail is submitted with valid authentication.
First response: Disable credential, stop affected queue flow, preserve evidence, rotate secrets and review sender authorization.
Decision tree
Start: Unexpected mail is submitted with valid authentication
↓
1. Contain risk and preserve logs
↓
2. Identify scope by VMTA, authenticated user, provider and time
↓
3. Compare with last known-good configuration and baseline
↓
4. Apply one reversible correction
↓
5. Validate with controlled traffic and accounting logs
Evidence to collect
- Exact timestamp and timezone
- Authenticated username or submission source
- Envelope sender and recipient domain
- Selected VMTA, source IP and HELO
- SMTP response and enhanced status code
- Relevant accounting and service-log records
- Last configuration change
Safe corrective sequence
- Pause only the affected stream when possible.
- Preserve the original response and configuration.
- Reproduce with one controlled test.
- Apply the smallest reversible change.
- Verify queue behavior and document the outcome.
Avoid
- Deleting queues before preserving evidence.
- Changing many directives simultaneously.
- Rotating source identities to bypass reputation controls.
- Assuming every temporary error is a rate problem.