Our availability objective, how we measure it, and what happens when things go wrong.
We target 99.9% monthly availability, as stated in our Terms of Service. Availability is measured by the same public probes everyone can see — not by a private definition.
Every 15 minutes, a synthetic probe sends a real message through the full stack — submission, delivery, and retrieval — and records the result, success or failure, on the public status page, along with a 30-day history and any incidents. If we have a bad day, you'll see it there before we could describe it away.
SMTP is store-and-forward: when a server is briefly unreachable, sending servers queue and retry for days — a short interruption delays mail rather than losing it. Our own outbound queue retries with backoff, gives up cleanly with a bounce only on permanent errors, and keeps a suppression list so hard-bouncing addresses aren't hammered. The platform is also designed for a warm-standby second MX that accepts and queues inbound mail during primary maintenance and forwards it on afterwards — proven in live relay drills.
Routine updates are deployed without dropping connections' mail: inbound delivery resumes within seconds, and the retry behavior above covers the gap. Anything expected to be disruptive is announced in advance to administrators.
See also Security & Trust.