Use when performing email deliverability troubleshooting — email delivery issues investigation workflow covering bounce analysis, spam filter diagnosis, SPF/DKIM/DMARC validation, mail flow tracing, and mailbox quota management. Guides helpdesk agents through systematic diagnosis of email delivery failures for both sending and receiving issues.
Investigating email issue for {{ user_name }} Direction: {{ email_direction }} | Platform: {{ email_platform }} Other party: {{ recipient_or_sender }}
START: What is the email issue?
│
├─ Emails Not Being SENT
│ ├─ Bounce-back / NDR received?
│ │ ├─ Yes → Analyze NDR error code (see below)
│ │ └─ No → Check outbox, stuck in queue?
│ ├─ Sending to all recipients or specific ones?
│ │ ├─ All → Account or server issue
│ │ └─ Specific → Recipient-side issue
│ └─ Attachment issues?
│ └─ Check size limits (typically 25-35MB)
│
├─ Emails Not Being RECEIVED
│ ├─ From all senders or specific?
│ │ ├─ All → Mailbox or routing issue
│ │ └─ Specific → Spam filter or sender issue
│ ├─ Check spam/junk folder
│ ├─ Mailbox full?
│ └─ Mail flow rules blocking?
│
└─ Emails Delayed
├─ Internal or external?
├─ Check mail queue on server
└─ DNS/MX record issues?
Common NDR codes and meanings:
| Code | Meaning | Action |
|---|---|---|
| 550 5.1.1 | Recipient does not exist | Verify recipient address spelling |
| 550 5.7.1 | Relay denied / not authorized | Check authentication, connector config |
| 552 5.2.2 | Mailbox full | Recipient needs to clear space |
| 554 5.7.1 | Message rejected (spam) | Check SPF/DKIM/DMARC, content filters |
| 421 4.7.0 | Temporary failure, try later | Server greylisting, retry automatically |
| 550 5.4.1 | Recipient domain not found | Verify domain exists, check MX records |
nslookup -type=txt domain.com — look for v=spf1nslookup -type=txt _dmarc.domain.comEscalate to email/messaging team if:
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Generate a diagnostic report with: