Building an Email Broadcast Engine That Survives Retries

Short summary

A detailed architecture write-up for a production email broadcast engine that survives retries and double dispatches. The core design principle is making the recipient ledger the source of truth — each queued job re-checks row status before sending, making retries no-ops without distributed locks. Delivery webhooks use a monotonic rank guard to prevent out-of-order status downgrades, and tokenized opt-out links avoid leaking token validity to attackers.

• •One queued job per recipient with status re-check makes retries idempotent without locks
• •Monotonic rank guard on webhooks prevents out-of-order events from downgrading status
• •Suppression scope and tokenized opt-out back-fill keep reports honest and prevent oracle attacks

Generated with AI, which can make mistakes.