PRE-ESCALATION CHECKLIST
[ ] Unauthorized traffic stopped
[ ] Credentials rotated where required
[ ] Exact SMTP response preserved
[ ] IP/PTR/EHLO confirmed
[ ] SPF pass confirmed
[ ] DKIM pass and alignment confirmed
[ ] DMARC pass confirmed
[ ] Complaint and invalid-recipient sources reviewed
[ ] Volume/concurrency stabilized
[ ] Issue reproduced after corrective action