Earlier quoted context omitted.
Being down is okay. Returning an error message that results in the data being thrown away instead of being requeued is not. Block incoming smtp connections until your app layer is fixed.
> Block incoming smtp connections until you app layer is fixed. Or returning one of the 4xx status codes which indicate less-permanent failure state like: - 451 Requested action aborted: local error in processing Which is kinda like a HTTP internal server error as it can mean anything.
Another option would’ve been to accept everything with a very lightweight smtp ingest service, journal it all, and play it back to the full frontend after their code fix was pushed out.
Not an SRE so ¯\_(ツ)_/¯ just some thoughts from my time in a similar role and similar pain points (but thankfully not at this scale)