How We Built the Auto-Pause Circuit Breaker
When a tenant's bounce rate hits 5%, we automatically suspend sending. This protects your sender reputation and prevents cascading failures.
Sender reputation is fragile. A sudden spike in bounces or complaints can tank your deliverability for weeks. We built the auto-pause circuit breaker to catch problems before they cascade.
The problem
When a tenant sends email to a list with stale addresses, bounces spike. Without intervention, the tenant keeps sending, the bounce rate climbs, and eventually the ISP starts throttling or blocking all email from that domain — including future campaigns with clean lists.
How the circuit breaker works
Relay monitors three metrics in real-time:
1. Bounce rate — if more than 5% of recent messages bounce, sending pauses 2. Complaint rate — if more than 0.1% of recipients mark as spam, sending pauses 3. Hard bounce velocity — a sudden spike in hard bounces triggers an immediate pause
When any threshold is breached, the circuit breaker trips:
- Sending stops — no more emails go out for this tenant
- The tenant is notified — via email and dashboard alert
- An admin is alerted — for manual review if needed
- Recovery requires action — the tenant must clean their list and request reactivation
Why this matters
This isn't just about protecting your reputation — it protects every other tenant on the platform. Shared sending infrastructure means one bad actor can affect deliverability for everyone.
The technical details
The circuit breaker runs in a Cloudflare Durable Object, which maintains per-tenant state at the edge. Every send request checks the current circuit state before proceeding. The state machine has three states:
- Closed — normal operation, emails flow freely
- Open — sending paused, threshold breached
- Half-open — after a cooldown period, limited sending resumes to test recovery
This is the same pattern used in distributed systems for fault tolerance — adapted for email.