Evidence
Use timestamps, queue IDs, remote responses, source IP, VMTA, sender domain and message class to establish the failure boundary. Avoid reacting to one isolated delivery attempt.
Checks
- Authoritative MX answers
- A/AAAA records for every MX
- DNSSEC validation state
- Resolver timeout and SERVFAIL rate
- Split-horizon or stale cache behavior
Recovery
Test through more than one resolver, correct authoritative data, then flush only the caches that actually contain stale answers.
Operational rule: collect evidence before changing policy, make one controlled change, verify the result, and retain a rollback path.