queue troubleshooting — production checklist

A structured starting point for queue troubleshooting with emphasis on production checklist.

Do not paste this unchanged into production. Replace documentation IPs, define authorization narrowly, check syntax against your release, and test with traffic you control.

Objective

This example demonstrates separation of identity, provider policy and authorization. It intentionally uses conservative values so operators can measure before increasing concurrency or rate.

Configuration

# Educational production checklist example: queue troubleshooting
# Replace all TEST-NET addresses and example domains.

<virtual-mta vmta-example>
    smtp-source-host 192.0.2.10 mail.example.com
</virtual-mta>

<domain *>
    max-smtp-out 1
    max-msg-per-connection 5
    retry-after 15m
    bounce-after 4d
</domain>

# Add the narrowest source or authenticated-user policy needed.
# Never enable open relaying.

Values to replace

Source IP and matching PTR/forward DNS/HELO.
VirtualMTA names and pool membership.
Source networks or SMTP users permitted to relay.
DKIM domain, selector and private-key path.
Provider policies derived from current SMTP evidence.

Validation

Validate syntax with the tools supplied in your installation.
Confirm the source IP exists and has a valid route.
Submit a controlled message and inspect queue selection.
Inspect received headers and Authentication-Results.
Confirm that an unauthorized sender or network is rejected.

Rollback

Restore the saved configuration, reload safely, and verify that queues are using the previous policy. Keep the failed change and its logs for post-incident review.