Complete procedures with a way back.

Generate a protected key, publish and verify DNS, sign only owned outbound domains, test canonicalization and alignment, monitor failures, and rehearse rotation.

Set a canonical identity, local domains, relay policy, DNS, TLS, aliases, queue monitoring, and end-to-end SMTP tests on Debian or Ubuntu.

Measure queue age and volume, inspect headers and bodies, trace routing and logs, retry individual messages, isolate frozen mail, and remove only proven unwanted entries.

Route non-local mail to an authenticated TLS relay, protect credentials, preserve local delivery, rewrite identities deliberately, and test failure behavior.

Install a trusted certificate, separate port 587 policy, require encryption before AUTH, integrate an authenticator, rate-limit abuse, and test relay boundaries.