You cannot recognize a meaningful change if you do not know what normal looks like.
Track, by major mail stream where possible:
- attempted and accepted volume;
- temporary and permanent failures;
- common enhanced status codes;
- complaint signals;
- authentication results;
- DMARC source trends;
- provider-specific reputation/health indicators;
- queue age and depth for infrastructure you operate.
Do not turn every metric into a pager alert. Establish ranges and trends, then alert on changes that require action.