The unsubscribe that never unsubscribed

A customer filed a spam complaint against one of our emails. The provider dutifully delivered the complaint webhook to our endpoint. Our consumer dutifully received it, processed it, and moved on.

It wrote no suppression entry. It raised no alert. The next campaign wave would have emailed that address again — a person who had just told the provider, in the strongest terms the email ecosystem offers, to stop.

We caught it in a routine log review, days later, by luck. That's the sentence that should scare you: the only thing standing between us and re-emailing someone who'd filed a spam complaint was a habit of reading logs on Fridays.

The event that fell through every gate

Our email consumer was built around one shape: a webhook carrying a message object. Inbound replies, delivery events, the happy path — they all arrived in that shape, and the consumer's processing gates were all written to expect it.

Bounce and spam-complaint webhooks don't carry a message object. They're a different event family — metadata about a send, not the send itself. So when they arrived, they walked up to every gate in the pipeline, failed every shape check, and fell through all of them. No gate was wrong, exactly. Each one correctly said "this isn't mine." Collectively, they formed a system that could receive a spam complaint and do absolutely nothing with it.

The verification trap: the consumer had excellent test coverage — for messages. Every test fed it the message shape and asserted the right behavior. Nobody fed it a bounce event, because the bounce path wasn't a feature anyone had built. It was a safety system nobody had built, and safety systems don't get test plans. They get assumptions.

The fix was to stop treating suppression as a branch of message processing and start treating it as its own first-class path: bounce and complaint events are inbox-agnostic, they bypass the message gates entirely, and they always write a suppression entry. No shape check gets to veto them.

The STOP that only half the system could hear

Same theme, different channel. Our email campaigns ran on two paths: a quarterly bulk path and an estimate-follow-up path. The quarterly path checked replies for unsubscribe keywords — STOP, UNSUBSCRIBE, the usual vocabulary — and suppressed the sender.

The estimate path didn't. A customer replied STOP to an estimate email, the reply sat in the log with its intent perfectly legible, and the next campaign wave re-emailed them anyway. The suppression file the sender actually consulted had no record of the request, because the code path that saw the request never wrote to it.

Two paths, one suppression file, and only one of the paths knew the file existed. The customer did everything right. The system heard them in one room and forgot them in the next.

The fix: the same STOP detection now runs on every path that sends email, and it writes to the same suppression file the sender actually consults. Not a copy. Not a second list. The file the send logic reads before every wave.

Suppression is a safety system, not a feature

Here's the framing that changed how we treat this code. A missed suppression write isn't a minor bug — it's CAN-SPAM-adjacent. Enough of them and the provider throttles you; enough of those and your sending domain is burned. A burned domain doesn't just kill campaigns. It kills transactional mail too — the receipts, the confirmations, the messages customers actually want.

So we run opt-out paths with the rigor we'd give a payment path:

Tested. Bounce events, complaint events, STOP replies on every send path — each one has a test that feeds the real event shape and asserts the suppression entry exists afterward.
Alerted. A complaint webhook that doesn't produce a suppression write within the same run pages someone. The safety system watches itself.
Never silently droppable. No shape check, no gate, no "not my department" is allowed to swallow a suppression event. If an event arrives that the consumer doesn't recognize, the default is to alert, not to ignore.

The payment-path comparison is deliberate. Nobody would ship a checkout flow where a failed charge "fell through the gates" quietly. An unsubscribe is the same class of obligation: the customer made a request, the law backs it up, and the system's job is to honor it — loudly, visibly, every time.

The list that vanished wholesale

The suppression file itself turned out to have a failure mode worse than a missed write: losing everybody at once. The loader read the file and looped over its entries inside one big try. When a single malformed entry — one row that wasn't the object shape the loop expected — raised inside that loop, the blanket except did what blanket excepts do: it returned the default. An empty dict. The entire do-not-text list, gone — not corrupted on disk, just never loaded, for every send until someone noticed.

One poison entry shouldn't be able to evict every good one. The loader now isolates its failures per entry: a row that can't be parsed is skipped and the rest survive; only a genuinely unreadable file fails open, and that's a documented, deliberate choice. The same pass caught a quieter mismatch: stored numbers weren't normalized the way the lookup normalizes them, so an entry saved in a fully formatted international form would never have matched the number it existed to suppress.

The lesson generalizes past suppression lists: a loader that fails wholesale turns one bad row into a total outage of the safety system it feeds. Fail per-entry. The cost of skipping one malformed row is a log line. The cost of dropping the whole list is texting someone who told you to stop.

Checklist

Feed your consumer the ugly event shapes. Test with bounces, complaints, and malformed payloads — not just the message shape the happy path uses.
Make suppression inbox-agnostic. Bounce and complaint handlers bypass message gates entirely. No shape check gets to veto a suppression write.
One suppression file, every path writes to it. If two send paths exist, both check STOP keywords and both write to the file the sender actually consults.
Alert when a complaint produces no suppression. The safety system watches itself; a complaint webhook with no resulting entry is a page, not a log line.
Default to alerting on unrecognized events. An event you don't understand is not an event you can safely ignore — especially in the opt-out path.
Treat opt-out code like payment code. Tested, alerted, audited. A burned sending domain kills transactional mail too, not just campaigns.
Make suppression loaders fail per-entry, never wholesale. One malformed row in the file must cost a skipped row, not the whole list — and stored keys must be normalized the same way the lookup normalizes them, or the prettiest entry in the file will never match.