How to Monitor SMTP and Email Delivery Failures
Transactional emails (such as onboarding welcomes, password resets, and subscription invoices) are critical to SaaS user retention and checkout conversion rates. If your mail delivery system fails, your product is effectively broken.
However, many engineering teams make the mistake of equating SMTP server availability with email deliverability. Your SMTP server can run at 100% availability while Gmail and Microsoft Outlook reject 30% of your messages due to reputation, SPF/DKIM record errors, or rate limits.
This guide details the three layers of email monitoring, explains key SMTP response codes, and provides a command-line script to trace SMTP connections.
1. The Three Layers of Email Monitoring
A comprehensive email monitoring strategy requires auditing separate components of the delivery chain:
- SMTP Service Reachability: Verifying that your application can connect, authenticate, and hand off mail payload to your provider (e.g., Amazon SES, SendGrid, Postmark) over secure TLS ports (465 or 587).
- Delivery and Bounce Metrics: Auditing what happens to the mail after handoff. You must track bounce rates, complaint metrics, and delivery latency.
- Domain Reputation Records: Monitoring your DNS zone for correct Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication (DMARC) configurations.
2. The SRE Mathematics of Deliverability
To prevent your domain from being blacklisted by spam filters, monitor your outbound email streams against strict SRE alert thresholds.
We calculate the Bounce Rate using this percentage equation:
[\text{Bounce Rate %} = \frac{\text{Bounced Emails}}{\text{Total Sent Emails}} \times 100]
To protect your sending IP reputation, establish the following warning and critical thresholds:
- Delivery Rate ((\text{Delivered} / \text{Sent})): Should remain above 95%. Trigger an alert if this drops below 92%.
- Bounce Rate: Should remain below 3%. Trigger an immediate critical alert if the bounce rate crosses 5%: [\text{Bounce Rate %} \ge 5.0% \implies \text{CRITICAL ALERT}]
- Complaint Rate (spam markings): Must remain below 0.1%. Any value above 0.2% will cause major mail hosts to throttle your domain.
3. SMTP Status Code Reference
When an email is rejected or deferred, the receiving mail server returns a three-digit SMTP response code. Use the table below to classify these responses:
| SMTP Response Code | Status Category | Operational Meaning | SRE Action |
|---|---|---|---|
250 OK | Success | Message accepted and queued for delivery. | Log transaction success. |
421 | Temporary | Service unavailable, receiver is shutting down. | Re-queue message for retry. |
450 | Temporary | Mailbox busy or temporary local lock. | Re-queue message for retry. |
550 | Permanent | Mailbox unavailable / domain not found. | Suppress future sending to address. |
554 | Permanent | Transaction failed (IP blacklisted / spam block). | Pause queue, inspect IP reputation. |
4. Querying SMTP Daemons Manually
To verify that your SMTP server is accepting secure TLS handshakes and authenticating correctly, run a manual query using openssl:
openssl s_client -connect smtp.sendgrid.net:465 -crlf
Once the connection is established and the TLS handshake completes, verify the SMTP server responds to basic EHLO commands:
# Command sent to server
EHLO yourdomain.com
# Expected server response verifying capability
250-smtp.sendgrid.net
250-8BITMIME
250-STARTTLS
250-AUTH PLAIN LOGIN
If the connection times out or fails during negotiation, the SMTP provider's network interface is down or blocked by your outbound firewall.
5. Integrating Webhooks for Event-Stream Monitoring
Do not try to parse logs to determine delivery rates. Instead, configure your application to consume event webhooks directly from your transactional email provider.
Map incoming events to your internal message IDs:
Sent Email -> SMTP/API -> Provider Webhook -> Ingest: [Delivered | Bounced | Complaint]
By storing these state events in your database, you can dynamically calculate bounce rates and calculate real-time deliverability curves.
6. Proactive Email Auditing with Pingzo
A failure in your email system can go unnoticed for hours because it does not trigger homepage downtime alerts. Pingzo helps you monitor your email infrastructure:
- SMTP Port Probes: Pingzo continuously audits ports 25, 465, and 587 from global locations to ensure your mail servers are reachable.
- SPF/DKIM/DMARC Monitors: Audits your DNS zone records to verify cryptographic records remain correctly configured, preventing domain spoofing blocks.
- WhatsApp Outage Alerts: If your outbound email queue encounters a spike in permanent bounces (550/554 errors), or if an SMTP port times out, Pingzo routes a warning log directly to your WhatsApp to minimize MTTR.