How can ESPs detect and pause bad senders?

ESPs monitor every customer to protect their shared infrastructure. Detection and response systems catch problems early.

Detection signals:

Bounce rates: Spikes in hard bounces suggest bad list quality. Thresholds trigger alerts (often 5-10% hard bounce rate).

Complaint rates: Feedback loop data shows who's generating spam reports. Above 0.1-0.3% triggers intervention.

Spamtrap hits: ESPs monitor known traps or receive reports from blocklist operators.

Anomaly detection: Sudden volume spikes, unusual sending patterns, or dramatic metric changes flag accounts for review.

Blocklist appearances: If sending IPs get listed, the ESP traces which customer caused it.

Response actions:

Throttling: Reduce sending speed to limit damage while investigating.

Pause/suspension: Stop all sending from the account pending review.

Pool isolation: Move the sender to lower-reputation IPs to protect good senders.

Account termination: Repeated violations result in permanent removal.

ESPs balance customer service against infrastructure protection. Legitimate senders with temporary issues get guidance; chronic offenders get removed.

The harbor authority inspects cargo and can quarantine ships carrying disease.