- November 2022
- Engineering Memo · External Release
Email infrastructure observability is the practice of making the state of your sending systems visible in real time, at a granularity that lets you catch problems before they become incidents. Most email operations teams reach this state reactively — they build observability after an incident revealed a gap — rather than by design.
The core of email infrastructure observability is the PowerMTA accounting log. This is not a summary report — it is a per-message delivery record, written for every SMTP attempt, that includes the sending IP, the destination ISP, the SMTP response code, the disposition (delivered, bounced, deferred), and timing data. Aggregated across even a modest sending programme, this produces thousands to millions of records per day. The question is not whether to collect it — PowerMTA generates it automatically — but how to process it into actionable signals.
The Three Alerting Tiers
Tier 1 — Immediate alerts (respond within 15 minutes). A new DNSBL listing on any sending IP. SMTP authentication failure rate above 1% on any stream. A previously-delivering ISP returning nothing but 5XX responses for 30 minutes. These are operational emergencies — the infrastructure is broken or blacklisted, and delay worsens the outcome.
Tier 2 — Same-day alerts (respond within 4 hours). Deferral rate at any major ISP above 15% for more than 2 hours. Gmail domain spam rate in Postmaster Tools above 0.08%. Queue depth on any virtual MTA above 3× normal for the time of day. DKIM signature pass rate below 98%. These indicate emerging problems that have not yet caused delivery incidents but will if unaddressed.
Tier 3 — Daily review items. Per-ISP deferral rate trend over the previous 7 days. Hard bounce rate by list segment. FBL complaint count by campaign and list source. SPF alignment pass rate by domain. These inform ongoing configuration decisions and list hygiene work.
Data Source Integration
The accounting log alone is insufficient — it reflects the MTA's view of delivery. Combining it with external data sources provides the full picture. Gmail Postmaster Tools provides the ISP's view of your domain reputation and spam classification rate, updated daily. Microsoft SNDS provides Microsoft's view of your IP reputation and complaint data. Yahoo Complaint Feedback Loop provides per-complaint data within seconds of complaint receipt. These three data sources, combined with the accounting log, cover approximately 80% of consumer email volume in English-speaking markets.
The infrastructure to integrate these: a time-series database (InfluxDB or Prometheus) that ingests accounting log records, scheduled fetches from Postmaster Tools and SNDS APIs, and FBL complaint records in real time. Dashboards in Grafana or similar that display the Tier 1/2/3 metrics for daily review. Alert rules that fire the Tier 1 and 2 alerts to on-call channels. The tooling investment is one-time; the operational benefit compounds daily.
Our managed infrastructure includes all three alerting tiers, with daily accounting log review, Postmaster Tools monitoring, SNDS data, and FBL complaint processing as standard. Infrastructure assessment →