A practitioner running 50k emails/day on SES told me his Postmark failover only triggers on SES errors. Sounds reasonable. Except a suppressed address never errors — SES accepts it, returns 200, and quietly drops it. The backup never fires.
This is the trap: failovers are built around API errors, but deliverability dies in the silent middle — suppressions, throttled sends, greylisting. Your fallback logic watches the wrong signal.
What actually works: treat the suppression list as a first-class delivery signal. Monitor bounces and complaints as events, not just error codes. If your failover can't see a suppressed address, it's not a failover — it's a decoration.
