Deliverability Incident Response

Deliverability Incident Response

Things break. When they do, you need a playbook — not panic. This skill is the triage decision tree.

The five incident types

Decision tree: "my reply rate dropped"

Step 1: Quantify the drop

Was this week's reply rate < 50% of last 4 weeks' average?
  Yes → real drop, continue triage
  No  → noise, wait another week

If drop is real:

Step 2: Is it campaign-specific or fleet-wide?

Are ALL campaigns dropping, or just one?
  All → fleet-level issue (infrastructure or copy pattern)
  One → campaign-specific (targeting, copy, list)

Step 3: Fleet-wide drop — check these in order

1. Smartlead Smart Delivery spam test (/email-deliverability-audit → run-spam-test.ts)

   • If inbox placement <70% → real deliverability issue, skip to Step 4
   • If inbox placement >85% → deliverability is fine, look at copy/targeting instead

2. Check domain authentication (/email-deliverability-audit → check-domain-auth.ts)

   • Missing DKIM on any domain → fix immediately (see /zapmail-domain-setup-public for reconnect steps)
   • DMARC policy=reject with alignment failures → temporarily lower to quarantine

3. Check warmup status (/smartlead-inbox-manager → list-health.ts)

   • If multiple inboxes blocked in warmup → warmup network flagged you
   • If reputation dropped "good" → "fair" on many inboxes → slow down sending volume

4. Check bounce rate (/email-deliverability-audit → audit-performance.ts)

   • If bounce >3% → list quality degraded
   • If bounce <1% but reply rate low → emails landing in spam (Step 1 result)

Step 4: You have a spam-placement problem — what to do

Time-ordered actions:

1. Immediate (today): Pause the highest-volume campaign. Stop damage.
2. Day 1: Run spam placement test on 2-3 sender subsets (tag=active vs tag=new). Find which cohort is worst.
3. Day 1: Check the spam-filter-details report from Smart Delivery — specifically which filters are firing. Common: DKIM_INVALID, HTML_MESSAGE, LINK_REDIRECT. Each has a specific fix.
4. Day 2: Fix the identified issues:
   • DKIM_INVALID → verify DKIM records across all domains, re-publish if needed
   • HTML_MESSAGE → simplify email body (fewer fonts, no inline CSS, no tracking pixels)
   • LINK_REDIRECT → remove or reduce links in email 1 (ideally 0 links)
5. Day 3-14: Slow down send volume. Cut daily send per inbox by 50% for a week. Reputation rebuilds slowly.
6. Day 14: Re-test spam placement. If back above 85% → resume normal volume.

Decision tree: "bounce rate spiked"

Step 0: Do you have enough bounces to read?

50 sends before a bounce rate means anything. Below that, one dead address reads as 2% and two read as 4% — straight through the 3% line. 30 classified bounces attributed to that specific sending domain before the bounce composition means anything. A domain with no sampled bounces has a 0% sender-originated share purely by construction, which looks exactly like a rotten list — and that is how an unmeasured domain gets a confident "go revalidate your list" verdict.

Step 1: Classify the bounces by SMTP code, not by hard/soft

Hard-vs-soft is too coarse to act on. The enhanced SMTP status code in the bounce DSN tells you whose fault it is. Pull the DSN from the bounced lead's message history and take the first [45].\d+.\d+ code in the body — DSN templates repeat the code and often quote unrelated examples further down in the "more info for admins" boilerplate.

⛔ 5.7.133 is noise, full stop. It means "the group only accepts messages from inside its organization" — someone else's distribution-list setting. It is frequently the single most common code in a real sample, and bucketing it as a sender problem will manufacture "burned domain" cancel candidates out of nothing.

Then compute, per sending domain (not per client — a client-level split cannot tell you which domain to act on):

sender_share = SENDER / (SENDER + LIST + BURNED)      # noise and throttle excluded
burned_share = BURNED / (SENDER + LIST + BURNED)

burned_share > 20%  (≥30 classified bounces)
  → BURNED, at any bounce rate. Evaluate this FIRST, before the rate gate — a domain
    that is majority-blocklisted at a 2.5% bounce rate is still burned.

bounce_rate > 3% AND sender_share < 25%
  → list quality problem. Revalidate.

bounce_rate > 3% AND sender_share 25-50%
  → both diseases at once. Fix the auth gap FIRST, then revalidate. Do not go chase
    the list when 40% of the failures are yours.

bounce_rate > 3% AND sender_share > 50% AND auth incomplete
  → SENDER_AUTH. Fixable. Fix the record, re-check in 7 days.

bounce_rate > 3% AND sender_share > 50% AND auth clean
  → BURNED. Configuration is clean and we are still refused.

bounce_rate > 5% either way
  → stop the campaign immediately to prevent ISP suspension, then classify.

rising 4.x share, low permanent bounce
  → throttle. Cut volume. Do not cancel.

Step 1b: Sampling — do not enumerate every bounce

A bounced row does not tell you which domain sent it; attribution only exists after you pull the message history. So you cannot stratify by domain up front. Spend a global budget and enforce the floor afterwards: sample evenly across the in-window roster (roster[::step], never offset=0 only, which is time-biased), budget roughly 30 × (domains you need a verdict on) × 1.5, and mark any domain that ends up under 30 attributed bounces as insufficient sample rather than judging it.

⚠️ Bounced-lead rosters typically return a campaign's entire history with no date parameter. Filter client-side on the sent date, or bounces from a campaign that finished six months ago will drive this week's decision.

⚠️ Message-history fetches fail transiently. Retry 3+ times with backoff before recording "no DSN available" — on a real run, 61 of 64 apparently body-less leads returned a body on retry.

Step 2: If list problem

1. Export remaining leads from the campaign
2. Run through MillionVerifier (batch, ~$2 per 1,000)
3. Only reuse emails with status "ok"
4. Discard the rest

Step 3: If reputation problem

Slow way down. Cut daily volume 50% per inbox for 2 weeks. Run warmup more aggressively.

Decision tree: "domain blacklisted"

Step 1: Confirm the blacklist

Check:

• Spamhaus, Barracuda, SURBL via /email-deliverability-audit → spam-test report → blacklist detail
• MX Toolbox (https://mxtoolbox.com/blacklists.aspx) for a second opinion

Step 2: What tier of blacklist?

• Domain on Spamhaus DBL or SURBL → serious. You may need to replace the domain entirely.
• Sending IP on a DNSBL → usually the IP pool's fault (not yours, if on Zapmail shared IPs). Zapmail rotates IPs; wait 1-2 weeks.
• Minor list (e.g., Barracuda) → submit delisting request at their portal. Usually resolved in 3-7 days.