If SpamExperts detects abusive outgoing mail, contain the affected sender before restoring delivery. Unlocking an account while the compromised application is still active can immediately restart the same abuse.
IN THIS ARTICLE
01 Contain and investigate
- Identify the affected domain, outgoing authentication account and sending identity from the logs.
- For an identified sender, open Outgoing > Manage Identities, search the domain and inspect the User and Identity columns. Use the matching row menu to select Lock. Locking the whole outgoing authentication method has a broader effect, so confirm its shared use before choosing that control.
- Inspect the sending application, mailbox and device for stolen credentials, unexpected scripts or unauthorised access.
- Rotate the affected secrets and remove the cause. Preserve relevant timestamps and log identifiers.
- Review queued or quarantined outgoing messages and separate legitimate business mail from abuse.
02 Restore carefully
After remediation, unlock through the authorised process and send a small controlled test. Monitor the same identity for renewed suspicious activity before returning high-volume applications to normal operation.
After the cause is resolved, the same identity row provides Unlock. Check its lock reason and the outgoing test result before treating restored authentication as a complete incident resolution.
Common questions
What is the difference between locking an identity and a relay user?
An identity can isolate an individual sender when identification is configured. Locking an authentication mechanism can affect all traffic using it. Inspect the actual configuration before selecting the broader control.
Is changing a password enough?
Not if a vulnerable website, exposed secret or malicious process can regain access. Fix the origin of the compromise as well as the credential.
Can I release all blocked outgoing mail?
Review it first. Releasing abuse can harm recipients and cause another lock. Ask us to assist where your role cannot safely inspect or release the relevant messages.
Document the cause, changes made and successful test evidence. Keep a follow-up review to remove temporary exceptions and confirm that every authorised sending application uses the new secure configuration.