PowerMTA Delivery Rate Suddenly Dropped — Diagnosis Checklist and Recovery Steps

First 15 Minutes: Triage Protocol

The first priority is scoping: is this affecting one ISP or all? One IP or the entire pool? Did it start with a specific campaign or gradually over hours? These answers determine which root cause category to investigate first.

# 1. Check overall status
pmta show status | grep -E "queue|delivered|deferred"

# 2. Identify which ISP is accumulating queue
pmta show queue --all | sort -k3 -rn | head -10

# 3. Check recent error patterns
tail -2000 /var/log/pmta/accounting.csv | \
  awk -F, '$1 ~ /[tb]/ {print substr($10,1,60)}' | sort | uniq -c | sort -rn | head -10

# 4. Find when the drop started
awk -F, 'NR>1 && $1=="d" {hour=substr($2,1,13); count[hour]++} END {
    for(h in count) print h, count[h]
}' /var/log/pmta/accounting.csv | sort | tail -12

Identify Scope by ISP and IP

# Per-ISP delivery rate (last 2 hours)
awk -F, -v cutoff="$(date -d '2 hours ago' '+%Y-%m-%dT%H:%M')" '
NR>1 && $2>=cutoff {
    split($6,a,"@"); d=a[2]
    if($1=="d") del[d]++; if($1=="t") def[d]++
} END {
    for(d in del) {
        t=del[d]+def[d]
        if(t>50) printf "%s: %.0f%% delivered (%d total)\n", d, del[d]/t*100, t
    }
}' /var/log/pmta/accounting.csv | sort -t: -k2 -n

# Per source-IP delivery rate
awk -F, 'NR>1 {
    if($1=="d") del[$15]++; if($1=="t") def[$15]++
} END {
    for(ip in del) printf "%s: %.0f%% delivered\n", ip, del[ip]/(del[ip]+def[ip])*100
}' /var/log/pmta/accounting.csv | sort -t: -k2 -n

Check for IP Blacklisting

# DNS blacklist checks for each sending IP
for IP in 185.x.x.10 185.x.x.11 185.x.x.12; do
    echo "=== $IP ==="
    # Reverse octets for DNS query
    REV=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
    
    # Spamhaus ZEN (covers SBL, XBL, PBL)
    dig +short $REV.zen.spamhaus.org 2>/dev/null
    
    # Spamhaus CSS (specific to spam sources)
    dig +short $REV.sbl.spamhaus.org 2>/dev/null
    
    # Barracuda
    dig +short $REV.b.barracudacentral.org 2>/dev/null
done

# Blacklist indicators in accounting log format:
grep -iE "blacklist|dnsbl|listed|blocked" /var/log/pmta/accounting.csv | \
  awk -F, '{print substr($10,1,80)}' | sort | uniq -c | sort -rn | head -10

# If listed: submit delisting requests immediately
# Spamhaus: https://check.spamhaus.org
# Barracuda: https://www.barracudacentral.org/rbl/removal-request

Check Reputation Data by Provider

# While waiting for reputation tools to update, read accounting log signals:
# Gmail reputation 421 pattern:
grep "gmail.com" /var/log/pmta/accounting.csv | \
  awk -F, '$1=="t" && $10~/4.7.0/ {count++} END {print "Reputation deferrals:", count}'

# Microsoft RP block pattern:
grep "outlook.com" /var/log/pmta/accounting.csv | \
  awk -F, '$1=="t" && $10~/RP-00/ {print substr($10,1,40)}' | sort | uniq -c

Check Recent Configuration Changes

# Config file modification time
ls -la /etc/pmta/config /etc/pmta/*.conf 2>/dev/null

# Recent config reload events
grep "reload\|restart\|config loaded" /var/log/pmta/pmta.log | tail -10

# DKIM key validation
pmta check-dkim --domain=yourdomain.com --selector=s1 2>/dev/null || \
  echo "DKIM check failed — verify key files and DNS record"

# DNS record spot-check
dig TXT yourdomain.com | grep "v=spf1"
dig TXT _dmarc.yourdomain.com | grep "v=DMARC1"
dig TXT s1._domainkey.yourdomain.com | grep "v=DKIM1"

Authentication Verification

# Send a test message and verify headers in receiving mailbox
# Check for in Gmail received headers:
# Authentication-Results: mx.google.com;
#   dkim=pass header.i=@yourdomain.com header.s=s1
#   spf=pass (google.com: domain of bounce@mail.yourdomain.com)
#   dmarc=pass (p=REJECT header.from=yourdomain.com)

# Authentication failures in accounting log (550 5.7.26 = DMARC failure):
grep "550 5.7.26\|dmarc\|DMARC" /var/log/pmta/accounting.csv | wc -l
# Any count above 0 requires immediate authentication debugging

Recovery Protocol by Root Cause

Frequently Asked Questions