How do I investigate a delivery spike in failures?

To investigate a spike in delivery failures, use a structured approach so you can quickly isolate whether the issue is with the sender, recipients, content, infrastructure, or a downstream provider.

1) Confirm the spike is real

• Compare failure rate against a baseline:
  • same time yesterday
  • same day last week
  • rolling 24h/7d average
• Check whether the spike is:
  • global or limited to a specific campaign, domain, region, or provider
  • hard failures only, or soft bounces / deferrals too

2) Classify the failure type

Group failures by error code or category:

• Authentication issues: SPF, DKIM, DMARC failures
• Reputation / policy blocks: spam, blacklisting, throttling
• Content-related: suspicious links, attachment type, wording
• Recipient issues: invalid addresses, unknown user, full mailbox
• Infrastructure issues: queue delays, timeouts, DNS issues, TLS problems
• Provider-specific issues: one mailbox provider rejecting or deferring

Look for the dominant failure reason first.

3) Segment the spike

Break down failures by:

• recipient domain/provider
• sending IP / domain
• campaign / message template
• region / data center / MTA
• time window

This often reveals whether the issue is isolated to one provider or one send path.

4) Check recent changes

Review anything that changed around the time the spike began:

• new content or template
• new sending IP/domain
• DNS changes
• authentication changes (SPF/DKIM/DMARC)
• list import or audience source changes
• volume increases or new sending pattern
• software deployments, routing changes, or certificate updates

A change in behavior often points directly to the cause.

5) Inspect delivery logs and provider responses

For representative failures, review:

• SMTP response codes and text
• bounce messages
• message IDs and correlation IDs
• retry behavior and deferral patterns

Examples:

• 5xx errors usually indicate permanent rejection
• 4xx errors usually indicate temporary deferral or throttling

6) Check sender reputation and authentication

• Validate SPF, DKIM, and DMARC alignment
• Check IP/domain reputation and blocklists
• Review complaint rates, bounce rates, and engagement
• Confirm the sending IP isn’t new, shared, or misconfigured

7) Verify recipient list hygiene

A spike can come from bad input:

• stale lists
• imported addresses
• typos or role accounts
• purchased/third-party lists
• sudden increase in invalid recipients

8) Look for provider-side throttling or policy changes

Mailbox providers may have:

• tightened filtering rules
• rate limits
• temporary outages
• regional issues

Check provider status pages and compare behavior across domains.

9) Test and reproduce

Send controlled test messages:

• to seed accounts at major providers
• with the same headers/content
• from the same IP/domain
• at lower volume

This helps determine whether the problem is content, reputation, or volume-related.

10) Mitigate while investigating

Depending on findings:

• pause or slow sends
• reduce volume to affected domains
• remove bad segments
• fix authentication/DNS issues
• adjust content or remove problematic links
• warm up IPs if volume changed abruptly
• contact provider support if blocks are domain-specific

A practical troubleshooting order

1. Identify affected domain/provider
2. Check failure codes and top error messages
3. Review recent changes
4. Validate SPF/DKIM/DMARC and DNS
5. Check reputation, rate limits, and blacklists
6. Inspect recipient quality and campaign content
7. Test with controlled sends
8. Mitigate and monitor

If you want, I can also give you:

• a step-by-step incident checklist
• a SQL/query template for analyzing failure spikes
• or a decision tree for interpreting SMTP bounce codes.