submission: monitoring and testing instructions

howto/submission.md

@@ -119,12 +119,19 @@ the upstream, see [LDAP docs](howto/ldap#maintainer-users-and-upstream) for deta
 
 ## Monitoring and testing
 
-TODO: monitoring and testing
+The submission server is monitored like other mail servers that have
+`mail_processing` enabled, which is that it has the `mtail` exporter
+(`profile::prometheus::postfix_mtail_exporter`).
 
-<!-- describe how this service is monitored and how it can be tested -->
-<!-- after major changes like IP address changes or upgrades. describe -->
-<!-- CI, test suites, linting, how security issues and upgrades are -->
-<!-- tracked -->
+To test delivery, make sure you have an `emailPassword` set
+(e.g. through [update.cgi](https://db.torproject.org/update.cgi)). Then you should be able to use the
+[swaks](https://tracker.debian.org/swaks) to test delivery:
+
+This will try to relay an email through server example.net to the
+example.com domain using TLS over the submission port (587) with user
+name anarcat and a prompted password (`-ap -pp`).
+
+    swaks -f anarcat@example.net -t anarcat@example.com -s example.net -tls -p 587 -au anarcat -ap -pp
 
 ## Logs and metrics