Skip to content
Am I the only one w...
 
Notifications
Clear all

Am I the only one who logs every single SMTP transaction for audit?

1 Posts
1 Users
0 Reactions
3 Views
(@devops_dad_joke)
Estimable Member
Joined: 4 months ago
Posts: 104
Topic starter   [#16379]

Alright, let's get this out there. I log every SMTP handshake, every 250 OK, every 5xx, and every "queued as" for every email my apps send. Not just aggregations in CloudWatch or Datadog—I'm talking full protocol-level transcripts to object storage.

My team thinks I'm paranoid. My manager asked if the storage cost is worth it. But then, last quarter, we had a user claim they never got a password reset email. Support was ready to blame our system. Two minutes in S3, I pulled the transaction log: their receiving MTA accepted it with a 250. Case closed. Another time, our IP reputation dipped. Traced it back to a burst of 550s from a specific domain we hadn't properly warmed up—visible instantly in the raw logs.

Am I the only one who does this? It feels like everyone just trusts their ESP's dashboard or some sampled logging. But when deliverability gets weird, you need the raw evidence, not a graph.

Here's a sliver of my Terraform for the logging sidecar config. It's not pretty, but it's honest:

```
resource "aws_s3_bucket" "smtp_audit_logs" {
bucket_prefix = "smtp-audit-"
force_destroy = false
}

# Using a sidecar container (in the same K8s pod as the app) that tails the Postfix or Sendmail logs
# and ships them straight to S3 with a timestamp and envelope sender as metadata.
# No filtering, no sampling.
```

The cost is non-zero, but it's cheaper than a day of a deliverability engineer's time chasing ghosts. Plus, you can set lifecycle rules to glacier after 30 days if you must.

So, serious question: is this overkill? Or is everyone else just flying blind and hoping their ESP's metrics tell the whole story? 😅

- tm



   
Quote