DOCUMENTATION

Incident Response Guide

How to report and respond to infrastructure and deliverability incidents

This guide describes what to do when you experience a deliverability problem, infrastructure issue, or security event. It covers how to contact us, what to include in your report, and what to expect from the Cloud Server for Email incident response process.

Severity Levels and Contact Methods

LevelDefinitionContact Method
P1 — CriticalFull service outage; PowerMTA not delivering; MailWizz inaccessibleEmail with URGENT subject + call +372 602-7190 (24/7)
P2 — HighMajor delivery degradation >30%; active blacklisting; Gmail 5xx block at volumeEmail: subject P2 INCIDENT (24/7 monitoring)
P3 — MediumDeferral rate 10–30% at one ISP; SNDS Yellow status; complaint spikeEmail: infrastructure@cloudserverforemail.com (business hours)
P4 — LowConfiguration questions; reporting queries; minor issuesEmail: infrastructure@cloudserverforemail.com (business hours)

What to Include in an Incident Report

  • Your sending domain(s) affected
  • Approximate time the problem started
  • Exact bounce message text or error (copy-paste, not screenshot if possible)
  • Recent changes: new campaign, list change, configuration change?
  • Which ISPs are affected (Gmail only? All ISPs?)
  • Current deferral rate or error rate from MailWizz statistics

Incident Response Process

1
Acknowledgment

We acknowledge within SLA response time. You receive confirmation that an engineer is investigating.

2
Initial Assessment

We review accounting logs, Postmaster Tools, SNDS, blacklist status. This takes 15–30 minutes for P1/P2.

3
Containment

We take immediate containment actions: pause affected ISP delivery, reroute traffic, or reduce volume.

4
Root Cause + Fix

We identify and fix the root cause. Changes are monitored for 2–4 hours to confirm effectiveness.

5
Post-Incident Report

P1/P2 incidents receive a written report: what happened, root cause, fix applied, prevention measures.

Common Incident Types

Blacklisting (Spamhaus, Barracuda, etc.)

Forward the exact bounce message containing the blacklist reference. We verify the listing, investigate root cause, and submit the removal request. Most major blacklist removals process within 24–48 hours of a valid request.

Gmail 5.7.x Rejections at Volume

Authentication failure (5.7.26 = DMARC fail; 5.7.28 = SPF fail) or policy block. Forward the exact bounce message. We diagnose the authentication configuration within 2 hours and repair same-day.

SNDS Yellow/Red (Outlook Delivery Problems)

Report via email with your SNDS screenshot. SNDS remediation involves identifying the traffic segment driving elevated complaint rates and removing those subscribers before requesting SNDS improvement.

Emergency Contact

P1 incidents: infrastructure@cloudserverforemail.com (subject: URGENT) + call +372 602-7190. For all other incidents: infrastructure@cloudserverforemail.com. Response time targets are per the Service Level Agreement.