28 lines
1.2 KiB
Markdown
28 lines
1.2 KiB
Markdown
|
---
|
||
|
|
id: "0003"
|
||
|
|
date: 2026-03-05
|
||
|
|
status: Accepted
|
||
|
|
supersedes: "0001"
|
||
|
|
superseded-by:
|
||
|
|
affected-paths: [lib/relay/delivery.rb]
|
||
|
|
affected-components: [delivery, retries]
|
||
|
|
---
|
||
|
|
|
||
|
|
# 0003 — Retry failed deliveries with exponential backoff, capped at five attempts
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
Fixed one-second retries hammered receivers that were already struggling: several endpoints throttle by IP, and back-to-back retries during an outage got our sender IP temporarily banned. The fixed-three-times policy from the earlier decision made outages worse, not better.
|
||
|
|
|
||
|
|
## Decision
|
||
|
|
|
||
|
|
Failed deliveries back off exponentially — 1s, 2s, 4s, 8s, 16s — and give up after five attempts. Retries are never issued back-to-back or in a tight loop; anything that re-sends a failed delivery must go through this backoff schedule.
|
||
|
|
|
||
|
|
## Consequences
|
||
|
|
|
||
|
|
Struggling receivers get breathing room and IP throttling is no longer triggered. A delivery can now take up to ~31 seconds to fail over all five attempts, so callers must not assume prompt failure.
|
||
|
|
|
||
|
|
## Alternatives rejected
|
||
|
|
|
||
|
|
Keeping fixed-interval retries rejected: it caused the IP bans. Immediate retry-until-success rejected outright: it is precisely the pattern receivers throttle. Jittered backoff deferred: single-sender volume does not need it yet.
|