How do you create a “reputation playbook” for future incidents?

The crisis is over. Your team's exhausted. The worst moment to write documentation is right then. The best moment is right then. Write it while the pain is fresh, while you remember exactly what nearly tanked your business.

Start with a postmortem, but keep it short. Write down what actually happened. Not interpretations, not blame. Facts: "On March 15th at 2 PM, complaint rate spiked to 3.2%." Include a timeline of how you discovered it, how long it took to trace the root cause, and what finally fixed it. This prevents you from repeating the same diagnosis mistakes next time.

Then document what you tried. What worked fast? What wasted time? If you spent six hours chasing a bad list import before realizing the real problem was authentication, write that down. The goal isn't to shame anyone. It's to skip straight to the working solution if it happens again.

Add a section on what you actually changed to recover. Did you re-authenticate your domain? Pause all sends for 48 hours? Run fresh validation? Which of those things moved the needle, and which were just noise? Write it down. Next time you're panicked, you'll know exactly what to do.

Then build your checklist. This is the heart of your playbook. It's what you'll actually use when the next incident hits. It should start with detection: what metrics trigger an alert? (complaint rate above 0.5%? Sudden deferral spike? Blocklist listing?) Then go through your decision tree: "If it's complaints, do X. If it's authentication, do Y." Include contact information for your ESP support team, any ISP contacts you have, and internal escalation paths.

Format matters more than you think. Bullet points for the checklist so it's scannable under stress. Narrative details in a separate section if someone needs the full context. Include the timeline from recovery so people know how long to expect each step to take.

Save it somewhere accessible to your whole team. Not buried in email. Not in someone's personal notes. A shared doc, a wiki page, a Google Drive folder, somewhere everyone can find it at 3 AM when the alerts are screaming.

This week, spend 90 minutes documenting this incident. You'll never regret building this while the memory's clear. The next person who handles a crisis will thank you.