Runbook for deliverability drop
Why it matters
A deliverability drop — bounce rate spike, complaint rate above Gmail's 0.1% threshold, or inbox placement collapse — requires immediate, structured triage. Without a runbook, operators improvise: they may pause all sends instead of isolating the affected campaign, spend 30 minutes finding the right dashboard query, or miss the SPF/DKIM check that would have identified the root cause in 2 minutes. NIST SP 800-53 IR-8 (Incident Response Plan) requires documented procedures for anticipated failure modes. RFC 5321 bounce handling standards define the specific events this runbook must cover.
Severity rationale
High because an undocumented deliverability incident response guarantees slower triage, which allows complaint rates to climb further past ESP thresholds during the response window.
Remediation
Create docs/runbooks/deliverability-incident.md with at least four sections: detection thresholds, triage checklist, immediate actions, and escalation contacts:
# Deliverability Incident Runbook
## Detection
- Bounce rate exceeds 5% over 1-hour window
- Complaint rate above 0.1% (Gmail threshold)
## Triage
1. Check bounce breakdown: `SELECT domain, count(*) FROM bounces WHERE ...`
2. Review Postmaster Tools for Gmail/Yahoo reputation
## Immediate Actions
- Pause affected campaign via admin API
- Verify DNS records (SPF, DKIM, DMARC)
## Escalation
- On-call: [name] via PagerDuty
- ESP support: [contact info]
The runbook must reference at least one numeric threshold — "bounce rate exceeds 5%" — to avoid the generic "contact ops" anti-pattern.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Operational Resilience (Email) Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.recoverability — Reliability / Recoverability — structured runbook required to restore deliverability after incident
- nist:rev5 · IR-8 — NIST 800-53 IR-8: Incident Response Plan
- external · RFC-5321-bounce — RFC 5321 §3.6 — SMTP bounce handling requires distinguishing permanent vs. transient failures for triage
Taxons
History
- 2026-04-18·v1.0.0·Initial import from operational-resilience-email·automated