50B
messages a day into 2 billion accounts
Assume 25 each. That’s about 580,000 a second, 1.2M at peak, most of it over SMTP from servers you don’t control.
When do you say 250 OK?
Bad: Say 250, then process
A crash or deploy loses mail the sender already deleted.
Good: Replicate, then say 250
Two of three zones confirm the queue write first. MTAs stay stateless.
Cheapest checks first, on the most messages
An IP check costs 0.1 ms; the full classifier 20 ms, or 24,000 cores at peak. So reject junk inside the SMTP session.
Spam slipped past the session and you said 250. Why not bounce it?
Never bounce
Its sender is forged. Your bounce hits a stranger, “backscatter”, and lands your IPs on blocklists. File it under Spam.
0.9 EB
of new mail a year; most never delete
Assume 50 KB a message. Metadata by user, bodies once by hash, compressed and erasure-coded: raw disk falls from 2.7 EB to 0.83 EB.
Offline for an hour? One pull catches you up.
Every change gets the next history ID in your log. Push only says “now at 1047”; the phone pulls since 1041. Lost hints break nothing.
Sending out: be a polite sender
- One queue per destination MX host
- Add connections slowly, halve after a 421
- Retry for five days, at least 30 minutes apart
- Bounce permanent failures from the empty sender <>
Remember
Say 250 only after a three-zone queue write, and reject junk inside the session. Key mail by user, bytes by hash; one change log drives sync, push and search.