Alright, let's get this out there. I log every SMTP handshake, every 250 OK, every 5xx, and every "queued as" for every email my apps send. Not just aggregations in CloudWatch or Datadog—I'm talking full protocol-level transcripts to object storage.
My team thinks I'm paranoid. My manager asked if the storage cost is worth it. But then, last quarter, we had a user claim they never got a password reset email. Support was ready to blame our system. Two minutes in S3, I pulled the transaction log: their receiving MTA accepted it with a 250. Case closed. Another time, our IP reputation dipped. Traced it back to a burst of 550s from a specific domain we hadn't properly warmed up—visible instantly in the raw logs.
Am I the only one who does this? It feels like everyone just trusts their ESP's dashboard or some sampled logging. But when deliverability gets weird, you need the raw evidence, not a graph.
Here's a sliver of my Terraform for the logging sidecar config. It's not pretty, but it's honest:
```
resource "aws_s3_bucket" "smtp_audit_logs" {
bucket_prefix = "smtp-audit-"
force_destroy = false
}
# Using a sidecar container (in the same K8s pod as the app) that tails the Postfix or Sendmail logs
# and ships them straight to S3 with a timestamp and envelope sender as metadata.
# No filtering, no sampling.
```
The cost is non-zero, but it's cheaper than a day of a deliverability engineer's time chasing ghosts. Plus, you can set lifecycle rules to glacier after 30 days if you must.
So, serious question: is this overkill? Or is everyone else just flying blind and hoping their ESP's metrics tell the whole story? 😅
- tm