Open with impact and one observation

State affected product/stream, environment, provider account/region, start time in UTC, current status, approximate authorized scope, and customer impact. Then give one reproducible example: “Message provider ID X submitted at 14:03 UTC received 451 4.7.x from host Y.” Avoid “email is broken everywhere” unless evidence supports it.

Include internal correlation ID, provider event ID, sending IP/pool, recipient provider/domain (not local part unless strictly needed), template/workflow, and retry attempt. Keep time zones consistent.

Attach minimum protocol evidence

Provide the exact bounded SMTP response or trusted Authentication-Results relevant to the issue, plus d=/s=/identity fields required for authentication diagnosis. Redact recipient/sender local parts, message body, unrelated headers, signed/reset URLs, cookies, authorization headers, and credentials.

If the provider truly needs a raw message, confirm that through the case, use its approved secure upload, get data-handling scope, and choose a synthetic reproduction where possible. Never paste private keys or API tokens.

Describe reproduction and controls

List steps using an authorized test account, expected versus observed outcome, frequency, first/last times, and whether a control message/stream works. Note DNS/config/deployment/volume/template/list changes with exact times and rollback status.

Summarize actions already taken and their evidence. Do not repeatedly retry production or change several variables while support investigates.

Ask answerable questions

Examples: Did provider account X route event Y through pool Z? Does the response map to a documented quota? Did the provider verify DKIM selector S before sending? Request logs or explanation within the provider’s control rather than asking for a universal inbox guarantee.

Close the loop

Record support’s confirmed cause separately from suggestions. Apply a reviewed fix, send a fresh reproduction, and verify receiver/provider evidence. Update the runbook, monitoring, and owner. Delete exceptional attachments according to incident retention.

A strong escalation lets support begin at the failed boundary while protecting customers. Its quality is measured by reproducibility and safe evidence, not attachment volume.